Analysis
- max time kernel
148s - max time network
147s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
19/01/2022, 09:47
General
- Target fe6c034412fb96a3d6e8f1c2d636041f.exe
- Size 1002KB
- Sample220119-lr7snagggm
- SHA256 a7017af2c60c1c5bc06d07f88e12d3b471a8787e233969d92ac6048d303cd682
Malware Config
Extracted
-
xloader
-
2.5
-
fu6b
-
golpoalo.com
-
bukkakenfts.com
-
onlinefpt.net
-
mailverifier.info
-
budobash.com
-
fieldsauction.online
-
qannual.com
-
leisiy.com
-
rotakb.com
-
edirneesnafim.com
-
motispeach.biz
-
weddinghairjewelry.com
-
kendama-co.com
-
v-kulture.info
-
mictrangan.com
-
stg-metro2paas-test.com
-
nodefius.com
-
greatdayelectrical.com
-
zsubastas.com
-
robboliver.pro
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fe6c034412fb96a3d6e8f1c2d636041f.exe"C:\Users\Admin\AppData\Local\Temp\fe6c034412fb96a3d6e8f1c2d636041f.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1092-55-0x0000000000230000-0x0000000000231000-memory.dmp
memory/1092-53-0x0000000075D61000-0x0000000075D63000-memory.dmp
memory/1360-72-0x0000000006A10000-0x0000000006B50000-memory.dmp
memory/1360-81-0x0000000006C20000-0x0000000006D68000-memory.dmp
memory/1360-75-0x0000000006DF0000-0x0000000006F94000-memory.dmp
memory/1516-77-0x0000000000930000-0x0000000000948000-memory.dmp
memory/1516-78-0x0000000000090000-0x00000000000B9000-memory.dmp
memory/1516-79-0x00000000021B0000-0x00000000024B3000-memory.dmp
memory/1516-80-0x0000000000470000-0x0000000000500000-memory.dmp
memory/1648-70-0x0000000002230000-0x0000000002533000-memory.dmp
memory/1648-71-0x0000000000240000-0x0000000000251000-memory.dmp
memory/1648-68-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/1648-73-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/1648-74-0x0000000000310000-0x0000000000321000-memory.dmp
memory/1648-67-0x0000000000090000-0x0000000000091000-memory.dmp
memory/1648-64-0x0000000000080000-0x0000000000081000-memory.dmp
memory/1648-63-0x0000000072480000-0x00000000724A9000-memory.dmp