Analysis
- max time kernel
157s - max time network
154s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
25/01/2022, 20:07
General
- Target Halkbank,pdf.exe
- Size 836KB
- Sample220125-yvzbxaecd8
- SHA256 fb1d5c8b2bd6b47bfeea96c2d66155232e2b67a2e6382980af8ee36bdb31362a
Malware Config
Extracted
-
xloader
-
2.5
-
n8bs
-
monese-bank.com
-
silkypumps.xyz
-
tashabouvier.com
-
eduardoleonsilva.com
-
pinnaclecorporaterentals.com
-
megafluids.com
-
worldwidecarfans.com
-
benjamlnesq.com
-
unitedraxiapp.com
-
thetanheroes.com
-
jypmore.quest
-
indianasheriffs.biz
-
saintinstead.com
-
alldansmx.com
-
trulyproofreading.com
-
indotogel369.com
-
mermadekusse.store
-
radosenterprisellc.com
-
gseequalservices.com
-
techride.xyz
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Halkbank,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank,pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Halkbank,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank,pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Halkbank,pdf.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2612-128-0x00000000069D0000-0x0000000006B42000-memory.dmp
memory/2612-136-0x0000000000EB0000-0x0000000000F48000-memory.dmp
memory/2612-131-0x00000000056B0000-0x000000000581D000-memory.dmp
memory/3444-116-0x0000000005430000-0x000000000592E000-memory.dmp
memory/3444-117-0x0000000005010000-0x00000000050A2000-memory.dmp
memory/3444-118-0x0000000004FD0000-0x0000000004FDA000-memory.dmp
memory/3444-119-0x0000000005230000-0x00000000052CC000-memory.dmp
memory/3444-120-0x0000000004F30000-0x000000000542E000-memory.dmp
memory/3444-121-0x0000000005A70000-0x0000000005A7E000-memory.dmp
memory/3444-122-0x000000007F190000-0x000000007F191000-memory.dmp
memory/3444-123-0x0000000005FA0000-0x0000000006048000-memory.dmp
memory/3444-115-0x00000000006C0000-0x0000000000798000-memory.dmp
memory/4192-126-0x00000000018F0000-0x0000000001C10000-memory.dmp
memory/4192-129-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4192-127-0x0000000001750000-0x00000000018E5000-memory.dmp
memory/4192-130-0x0000000001D10000-0x0000000001D21000-memory.dmp
memory/4192-124-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4392-133-0x0000000000900000-0x0000000000929000-memory.dmp
memory/4392-132-0x0000000001060000-0x0000000001076000-memory.dmp
memory/4392-134-0x0000000004950000-0x0000000004C70000-memory.dmp
memory/4392-135-0x0000000004610000-0x00000000047A2000-memory.dmp