Analysis
- max time kernel
154s - max time network
157s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
20/01/2022, 08:13
General
- Target DHL AWB AND INV.exe
- Size 374KB
- Sample220120-j4e73agheq
- SHA256 0450f9017a4e7556c6bbfa5e69363ed935e11fa47efff5755b172103b3b59892
Malware Config
Extracted
-
xloader
-
2.5
-
uite
-
cdbydx.xyz
-
tomreagan.com
-
brandonhopital.com
-
185891.com
-
huoalen920thuqn.com
-
chaudharyhamza.com
-
bhbju.com
-
localagencytools.com
-
weswicke.com
-
validationlinkedterms.digital
-
kpenotaryservices.online
-
bestmodsforminecraft.com
-
sunflowerproducts.net
-
bottlekill.com
-
matchercc.info
-
econuera.com
-
new-passion.com
-
candy-crocs.com
-
lmgenapparel.com
-
flex-a-porte.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL AWB AND INV.exe"C:\Users\Admin\AppData\Local\Temp\DHL AWB AND INV.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL AWB AND INV.exe"C:\Users\Admin\AppData\Local\Temp\DHL AWB AND INV.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DHL AWB AND INV.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/368-67-0x0000000000320000-0x0000000000331000-memory.dmp
memory/368-59-0x0000000000400000-0x0000000000429000-memory.dmp
memory/368-60-0x0000000000400000-0x0000000000429000-memory.dmp
memory/368-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/368-63-0x00000000007F0000-0x0000000000BF3000-memory.dmp
memory/368-64-0x0000000000180000-0x0000000000191000-memory.dmp
memory/368-66-0x0000000000400000-0x0000000000429000-memory.dmp
memory/760-55-0x0000000075D61000-0x0000000075D63000-memory.dmp
memory/760-56-0x0000000000840000-0x0000000000841000-memory.dmp
memory/760-57-0x0000000000550000-0x000000000055C000-memory.dmp
memory/760-58-0x0000000005210000-0x000000000526E000-memory.dmp
memory/760-54-0x0000000001120000-0x0000000001184000-memory.dmp
memory/1360-65-0x0000000006410000-0x0000000006512000-memory.dmp
memory/1360-68-0x0000000006860000-0x000000000694D000-memory.dmp
memory/1360-75-0x0000000006A10000-0x0000000006B56000-memory.dmp
memory/1644-70-0x00000000745C1000-0x00000000745C3000-memory.dmp
memory/1644-71-0x00000000009C0000-0x0000000000C41000-memory.dmp
memory/1644-72-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/1644-73-0x0000000002320000-0x0000000002623000-memory.dmp
memory/1644-74-0x00000000020E0000-0x0000000002170000-memory.dmp