Analysis
- max time kernel
152s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
19/01/2022, 09:47
General
- Target fe6c034412fb96a3d6e8f1c2d636041f.exe
- Size 1002KB
- Sample220119-lr7snagggm
- SHA256 a7017af2c60c1c5bc06d07f88e12d3b471a8787e233969d92ac6048d303cd682
Malware Config
Extracted
-
xloader
-
2.5
-
fu6b
-
golpoalo.com
-
bukkakenfts.com
-
onlinefpt.net
-
mailverifier.info
-
budobash.com
-
fieldsauction.online
-
qannual.com
-
leisiy.com
-
rotakb.com
-
edirneesnafim.com
-
motispeach.biz
-
weddinghairjewelry.com
-
kendama-co.com
-
v-kulture.info
-
mictrangan.com
-
stg-metro2paas-test.com
-
nodefius.com
-
greatdayelectrical.com
-
zsubastas.com
-
robboliver.pro
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fe6c034412fb96a3d6e8f1c2d636041f.exe"C:\Users\Admin\AppData\Local\Temp\fe6c034412fb96a3d6e8f1c2d636041f.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/856-193-0x00000000001B0000-0x00000000001C6000-memory.dmp
memory/856-195-0x0000000004EB0000-0x00000000051FA000-memory.dmp
memory/856-194-0x0000000002D90000-0x0000000002DB9000-memory.dmp
memory/856-196-0x0000000004D10000-0x0000000004DA0000-memory.dmp
memory/2156-130-0x0000000000810000-0x0000000000811000-memory.dmp
memory/2368-187-0x0000000002FB0000-0x0000000002FB1000-memory.dmp
memory/2368-188-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/2368-190-0x00000000052B0000-0x00000000055FA000-memory.dmp
memory/2368-191-0x00000000034C0000-0x00000000034D1000-memory.dmp
memory/2416-192-0x00000000072F0000-0x00000000073AC000-memory.dmp
memory/2416-197-0x00000000073B0000-0x00000000074AA000-memory.dmp