Analysis
- max time kernel
116s - max time network
138s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
25/01/2022, 10:30
General
- Target e4c892aef5cc8a224af323c3ad222a50.exe
- Size 816KB
- Sample220125-mjt29secc2
- SHA256 6e728d7a2e88ba45765fb4bbb1de4ddda1b3a402d5f31c04eddafe1962ab993c
Malware Config
Extracted
-
xloader
-
2.5
-
dpzz
-
roadstown.com
-
idfaltd.com
-
infotechsearchgroup.com
-
elcuentodelaprincesa.com
-
youkutiyu88.com
-
wildparkresort.com
-
iss-sa.com
-
jmglaser.com
-
criticalthinking.store
-
cabinetsossa.com
-
satseconomy.com
-
newendtech.com
-
gran-piel.com
-
accoya.net
-
timothyschmallrealt.com
-
valentikaeventos.com
-
majestineprojector.com
-
love-austria.com
-
hermetikyogusmalikombi.com
-
karasevda-jor.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4c892aef5cc8a224af323c3ad222a50.exe"C:\Users\Admin\AppData\Local\Temp\e4c892aef5cc8a224af323c3ad222a50.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e4c892aef5cc8a224af323c3ad222a50.exe"C:\Users\Admin\AppData\Local\Temp\e4c892aef5cc8a224af323c3ad222a50.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1100-127-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1100-128-0x0000000000F40000-0x0000000001260000-memory.dmp
memory/3208-118-0x0000000000680000-0x0000000000754000-memory.dmp
memory/3208-119-0x0000000005540000-0x0000000005A3E000-memory.dmp
memory/3208-120-0x0000000005120000-0x00000000051B2000-memory.dmp
memory/3208-121-0x0000000005100000-0x000000000510A000-memory.dmp
memory/3208-122-0x0000000005040000-0x000000000553E000-memory.dmp
memory/3208-123-0x0000000007610000-0x00000000076AC000-memory.dmp
memory/3208-124-0x00000000075F0000-0x00000000075FE000-memory.dmp
memory/3208-125-0x000000007ED20000-0x000000007ED21000-memory.dmp
memory/3208-126-0x0000000007AC0000-0x0000000007B6E000-memory.dmp