Analysis
- max time kernel
152s - max time network
151s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
26/01/2022, 16:29
General
- Target Product Details of Mini IOT CASE 2022.exe
- Size 542KB
- Sample220126-ty8yasfga8
- SHA256 dec8cfd95e7f3b0db46981117fe82eb59daab642c20c1e1ecaffe45df22af8c8
Malware Config
Extracted
-
xloader
-
2.5
-
s9ne
-
digital-performance-award.com
-
fioratti.xyz
-
designluxre.com
-
cngangdun.com
-
restaurantperladelmare.com
-
davinci65.info
-
glossmans.com
-
firstsmileimaging.com
-
indevmobility.biz
-
mvptcodesupport.com
-
crustenc.net
-
raleighsportsacademy.com
-
boytoyporn.com
-
rojaspass.com
-
acmepaysage.fr
-
shopatdean.xyz
-
leonergsteve18870.com
-
elnahuel.com
-
ils.network
-
canto-libero.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Product Details of Mini IOT CASE 2022.exe"C:\Users\Admin\AppData\Local\Temp\Product Details of Mini IOT CASE 2022.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Product Details of Mini IOT CASE 2022.exe"C:\Users\Admin\AppData\Local\Temp\Product Details of Mini IOT CASE 2022.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Product Details of Mini IOT CASE 2022.exe"C:\Users\Admin\AppData\Local\Temp\Product Details of Mini IOT CASE 2022.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Product Details of Mini IOT CASE 2022.exe"C:\Users\Admin\AppData\Local\Temp\Product Details of Mini IOT CASE 2022.exe"3⤵
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Product Details of Mini IOT CASE 2022.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2656-115-0x0000000005F60000-0x000000000645E000-memory.dmp
memory/2656-116-0x0000000005900000-0x0000000005992000-memory.dmp
memory/2656-117-0x00000000032B0000-0x00000000033F0000-memory.dmp
memory/2656-118-0x0000000005870000-0x000000000587A000-memory.dmp
memory/2656-119-0x0000000005A40000-0x0000000005A4C000-memory.dmp
memory/2656-120-0x0000000007FD0000-0x000000000806C000-memory.dmp
memory/2656-121-0x0000000008150000-0x00000000081B2000-memory.dmp
memory/2656-114-0x0000000000F90000-0x000000000101E000-memory.dmp
memory/3056-126-0x0000000002790000-0x000000000284F000-memory.dmp
memory/3056-131-0x0000000002910000-0x00000000029CA000-memory.dmp
memory/3860-127-0x0000000000F10000-0x0000000000F2F000-memory.dmp
memory/3860-128-0x0000000000710000-0x0000000000739000-memory.dmp
memory/3860-129-0x0000000004A10000-0x0000000004D30000-memory.dmp
memory/3860-130-0x00000000046E0000-0x000000000486E000-memory.dmp
memory/4036-125-0x0000000000F90000-0x000000000112C000-memory.dmp
memory/4036-124-0x0000000001410000-0x0000000001730000-memory.dmp
memory/4036-122-0x0000000000400000-0x0000000000429000-memory.dmp