Analysis
- max time kernel
152s - max time network
151s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
27/01/2022, 12:50
General
- Target AeYNBknvOvHA5AC.exe
- Size 538KB
- Sample220127-p2x8radce5
- SHA256 b1fdff098dabc1d5beb91484f6f82637f359cb0f7fb4764b282c299c2d341ffa
Malware Config
Extracted
-
xloader
-
2.5
-
p89m
-
wrapapplausechutney.xyz
-
covidmobiletestingmd.com
-
convey.gifts
-
b148tlrfee9evtvorgm5947.com
-
zmlhtjfls.com
-
mctrumpthyism.com
-
lilaixi.store
-
interstatehardwarenj.com
-
horakokode.com
-
42wilsonavenue.com
-
muskanphysio.com
-
absoluteuniquecrafts.store
-
donategame.online
-
greenlinkengineering.net
-
pinchanzosloyalty.com
-
companyintel.network
-
resumewriterguru.com
-
oakalleyatcimarron.com
-
sriyawealthplan.com
-
mpcollection.online
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AeYNBknvOvHA5AC.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/560-131-0x0000000005430000-0x00000000054C0000-memory.dmp
memory/560-130-0x0000000005000000-0x00000000050AE000-memory.dmp
memory/560-129-0x0000000004D50000-0x0000000004D79000-memory.dmp
memory/560-128-0x00000000001F0000-0x00000000001FA000-memory.dmp
memory/3024-126-0x0000000004B40000-0x0000000004CCB000-memory.dmp
memory/3024-132-0x00000000024B0000-0x0000000002567000-memory.dmp
memory/3424-123-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3424-125-0x0000000001330000-0x0000000001650000-memory.dmp
memory/3424-127-0x0000000001800000-0x0000000001811000-memory.dmp
memory/3764-122-0x0000000007CF0000-0x0000000007D52000-memory.dmp
memory/3764-115-0x0000000000B30000-0x0000000000BBC000-memory.dmp
memory/3764-121-0x0000000007B40000-0x0000000007BDC000-memory.dmp
memory/3764-120-0x00000000053A0000-0x000000000589E000-memory.dmp
memory/3764-119-0x0000000005890000-0x000000000589C000-memory.dmp
memory/3764-118-0x0000000005430000-0x000000000543A000-memory.dmp
memory/3764-117-0x0000000005440000-0x00000000054D2000-memory.dmp
memory/3764-116-0x00000000058A0000-0x0000000005D9E000-memory.dmp