Analysis
- max time kernel
149s - max time network
152s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
27/01/2022, 14:34
General
- Target 2t9KtoR9xzpJY4E.exe
- Size 836KB
- Sample220127-rxexqaega2
- SHA256 f79592d7f8ba73cf16c31b3ac92427cdf99789a3eece4c873d0522b3429a783f
Malware Config
Extracted
-
xloader
-
2.5
-
cbgo
-
tablescaperendezvous4two.net
-
abktransportllc.net
-
roseevision.com
-
skategrindingwheels.com
-
robux-generator-free.xyz
-
yacusi.com
-
mgav35.xyz
-
paravocecommerce.com
-
venkatramanrm.com
-
freakyhamster.com
-
jenaashoponline.com
-
dmozlisting.com
-
lorrainekclark.store
-
handyman-prime.com
-
thecrashingbrains.com
-
ukpms.com
-
livingstonemines.com
-
papeisonline.com
-
chrisbakerpr.com
-
omnipets.store
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2t9KtoR9xzpJY4E.exe"C:\Users\Admin\AppData\Local\Temp\2t9KtoR9xzpJY4E.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2t9KtoR9xzpJY4E.exe"C:\Users\Admin\AppData\Local\Temp\2t9KtoR9xzpJY4E.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\2t9KtoR9xzpJY4E.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/560-60-0x0000000000400000-0x0000000000429000-memory.dmp
memory/560-64-0x0000000000920000-0x0000000000C23000-memory.dmp
memory/560-65-0x00000000001C0000-0x00000000001D1000-memory.dmp
memory/560-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/560-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/928-58-0x000000007EF40000-0x000000007EF41000-memory.dmp
memory/928-59-0x00000000056C0000-0x0000000005768000-memory.dmp
memory/928-54-0x0000000000840000-0x0000000000918000-memory.dmp
memory/928-57-0x0000000001F20000-0x0000000001F2E000-memory.dmp
memory/928-56-0x0000000004960000-0x0000000004961000-memory.dmp
memory/928-55-0x0000000075531000-0x0000000075533000-memory.dmp
memory/1216-66-0x0000000003A60000-0x0000000003B0F000-memory.dmp
memory/1216-71-0x0000000004BD0000-0x0000000004D16000-memory.dmp
memory/1724-67-0x0000000000260000-0x0000000000268000-memory.dmp
memory/1724-68-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/1724-69-0x00000000007D0000-0x0000000000AD3000-memory.dmp
memory/1724-70-0x0000000000500000-0x0000000000590000-memory.dmp