Analysis
- max time kernel
151s - max time network
149s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
24/01/2022, 09:57
General
- Target PO 3003786473_pdf.exe
- Size 417KB
- Sample220124-lyxw2aeag6
- SHA256 37182811d9f3a0a2b3126266dc70a5253c4745de7e18e75a4c29393fbdedb142
Malware Config
Extracted
-
xloader
-
2.5
-
b23k
-
foxsistersofhydesville.com
-
jetronbang.com
-
agriturismopartingoli.com
-
ihiinscus.com
-
zaksrestaurants.store
-
aspetac.com
-
ycjhjd.com
-
fountainspringscapemay.com
-
earlydose.com
-
nocodebelgium.com
-
65235.xyz
-
yasesite.com
-
steeltoilets.com
-
xceqa.xyz
-
2021udtv.com
-
belorusneft.top
-
the4asofdekhockey.com
-
gertexhosiery.com
-
fidelismortgages.com
-
bellacomoninguna.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 4 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\PO 3003786473_pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO 3003786473_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 3003786473_pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO 3003786473_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO 3003786473_pdf.exe"5⤵
-
-
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2460-121-0x0000000004F80000-0x0000000004F8E000-memory.dmp
memory/2460-116-0x00000000050F0000-0x00000000055EE000-memory.dmp
memory/2460-117-0x0000000004BF0000-0x0000000004C82000-memory.dmp
memory/2460-118-0x0000000004B50000-0x0000000004B5A000-memory.dmp
memory/2460-119-0x0000000004BF0000-0x00000000050EE000-memory.dmp
memory/2460-120-0x0000000005790000-0x000000000582C000-memory.dmp
memory/2460-115-0x0000000000180000-0x00000000001EE000-memory.dmp
memory/2460-122-0x000000007EAD0000-0x000000007EAD1000-memory.dmp
memory/2460-123-0x0000000005A30000-0x0000000005A8E000-memory.dmp
memory/2776-135-0x0000000004CA0000-0x0000000004D30000-memory.dmp
memory/2776-134-0x00000000048F0000-0x0000000004C10000-memory.dmp
memory/2776-133-0x0000000003220000-0x0000000003249000-memory.dmp
memory/2776-132-0x0000000000E60000-0x0000000000E87000-memory.dmp
memory/3024-131-0x0000000006510000-0x00000000066B2000-memory.dmp
memory/3024-128-0x0000000002F50000-0x000000000301B000-memory.dmp
memory/3024-136-0x00000000030D0000-0x00000000031B7000-memory.dmp
memory/3724-130-0x00000000034D0000-0x00000000034E1000-memory.dmp
memory/3724-129-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3724-127-0x0000000001210000-0x0000000001A90000-memory.dmp
memory/3724-126-0x0000000001710000-0x0000000001A30000-memory.dmp
memory/3724-124-0x0000000000400000-0x0000000000429000-memory.dmp