Analysis
- max time kernel
118s - max time network
123s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
19/01/2022, 17:13
General
- Target 97ae8e0ee6b8a129ffe8abe444d0754f.exe
- Size 466KB
- Sample220119-vreasabgh7
- SHA256 10ff5c8bac827b012bc5b6f789e7c23913b662453cd0bcc7f3f5192260d7a950
Malware Config
Extracted
-
xloader
-
2.5
-
p86f
-
lawrencetodolist.com
-
ci-ohio.com
-
otpravka-pochti-23v.xyz
-
evolutiondesign.academy
-
anentdugloord.com
-
niftyresult.com
-
partner2form.com
-
hffznt.com
-
asukas.online
-
heidefine.xyz
-
secure-c5.com
-
greenlink-engineering.com
-
dextraseo.online
-
apricitee.com
-
kenyansinus.com
-
dailangxiaozhan.com
-
deuxfemmes.store
-
overway.store
-
herostea.com
-
shaneparrottllc.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\97ae8e0ee6b8a129ffe8abe444d0754f.exe"C:\Users\Admin\AppData\Local\Temp\97ae8e0ee6b8a129ffe8abe444d0754f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\97ae8e0ee6b8a129ffe8abe444d0754f.exe"C:\Users\Admin\AppData\Local\Temp\97ae8e0ee6b8a129ffe8abe444d0754f.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\97ae8e0ee6b8a129ffe8abe444d0754f.exe"C:\Users\Admin\AppData\Local\Temp\97ae8e0ee6b8a129ffe8abe444d0754f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/524-57-0x0000000000400000-0x0000000000429000-memory.dmp
memory/524-58-0x0000000000400000-0x0000000000429000-memory.dmp
memory/524-59-0x0000000000400000-0x0000000000429000-memory.dmp
memory/524-60-0x0000000000B40000-0x0000000000E43000-memory.dmp
memory/948-54-0x0000000075B51000-0x0000000075B53000-memory.dmp
memory/948-55-0x00000000008F0000-0x00000000008F1000-memory.dmp
memory/948-56-0x00000000008F1000-0x00000000008F2000-memory.dmp