Overview

overview

10

Static

static

TT Transmi...90.exe

windows7_x64

10

TT Transmi...90.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    21-01-2022 21:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TT Transmitted Copy TRVTT2200390.exe

  • Size

    706KB

  • MD5

    e08f07a15096d5eda6b9af217640692b

  • SHA1

    d97dde29c20cc83def959ede08e0194db4cd3453

  • SHA256

    071d14c83f00ed98e9c00926273cc741b6de2c4d74b7c02b63dce652ae5b8735

  • SHA512

    dc529b138f4083608551dd0028c8d971724a06432000b56f8baf9b787a0e810248f4892a8ad68276f0416d01a52473bc96c6025814f6bde3c434bb8e940c6291

Score
10/10
xloadern8bsloaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

n8bs

Decoy

monese-bank.com

silkypumps.xyz

tashabouvier.com

eduardoleonsilva.com

pinnaclecorporaterentals.com

megafluids.com

worldwidecarfans.com

benjamlnesq.com

unitedraxiapp.com

thetanheroes.com

jypmore.quest

indianasheriffs.biz

saintinstead.com

alldansmx.com

trulyproofreading.com

indotogel369.com

mermadekusse.store

radosenterprisellc.com

gseequalservices.com

techride.xyz

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader Payload 2 IoCs
    rat
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe
    "C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1592
    • C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe
      "C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"
      2⤵
        PID:1620
      • C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe
        "C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"
        2⤵
          PID:1476
        • C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe
          "C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"
          2⤵
            PID:576
          • C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe
            "C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"
            2⤵
              PID:1728
            • C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe
              "C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"
              2⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:1480
          • C:\Windows\Explorer.EXE
            C:\Windows\Explorer.EXE
            1⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:1192
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\SysWOW64\cmd.exe"
              2⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1756
              • C:\Windows\SysWOW64\cmd.exe
                /c del "C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"
                3⤵
                • Deletes itself
                PID:1380

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1192-71-0x0000000004B90000-0x0000000004C5F000-memory.dmp
            Filesize

            828KB

            Download
          • memory/1192-66-0x0000000004A10000-0x0000000004B88000-memory.dmp
            Filesize

            1.5MB

            Download
          • memory/1480-61-0x0000000000400000-0x0000000000429000-memory.dmp
            Filesize

            164KB

            Download
          • memory/1480-65-0x0000000000200000-0x0000000000211000-memory.dmp
            Filesize

            68KB

            Download
          • memory/1480-64-0x00000000009E0000-0x0000000000CE3000-memory.dmp
            Filesize

            3.0MB

            Download
          • memory/1480-62-0x0000000000400000-0x0000000000429000-memory.dmp
            Filesize

            164KB

            Download
          • memory/1480-60-0x0000000000400000-0x0000000000429000-memory.dmp
            Filesize

            164KB

            Download
          • memory/1592-58-0x0000000000650000-0x000000000065E000-memory.dmp
            Filesize

            56KB

            Download
          • memory/1592-59-0x00000000020A0000-0x00000000020FE000-memory.dmp
            Filesize

            376KB

            Download
          • memory/1592-54-0x0000000000140000-0x00000000001F8000-memory.dmp
            Filesize

            736KB

            Download
          • memory/1592-57-0x0000000004DB0000-0x0000000004E50000-memory.dmp
            Filesize

            640KB

            Download
          • memory/1592-56-0x0000000004880000-0x0000000004881000-memory.dmp
            Filesize

            4KB

            Download
          • memory/1592-55-0x0000000075471000-0x0000000075473000-memory.dmp
            Filesize

            8KB

            Download
          • memory/1756-67-0x000000004A6A0000-0x000000004A6EC000-memory.dmp
            Filesize

            304KB

            Download
          • memory/1756-68-0x00000000000C0000-0x00000000000E9000-memory.dmp
            Filesize

            164KB

            Download
          • memory/1756-69-0x0000000001F60000-0x0000000002263000-memory.dmp
            Filesize

            3.0MB

            Download
          • memory/1756-70-0x0000000002270000-0x0000000002300000-memory.dmp
            Filesize

            576KB

            Download