Analysis
- max time kernel
150s - max time network
153s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
27/01/2022, 14:34
General
- Target 2t9KtoR9xzpJY4E.exe
- Size 836KB
- Sample220127-rxexqaega2
- SHA256 f79592d7f8ba73cf16c31b3ac92427cdf99789a3eece4c873d0522b3429a783f
Malware Config
Extracted
-
xloader
-
2.5
-
cbgo
-
tablescaperendezvous4two.net
-
abktransportllc.net
-
roseevision.com
-
skategrindingwheels.com
-
robux-generator-free.xyz
-
yacusi.com
-
mgav35.xyz
-
paravocecommerce.com
-
venkatramanrm.com
-
freakyhamster.com
-
jenaashoponline.com
-
dmozlisting.com
-
lorrainekclark.store
-
handyman-prime.com
-
thecrashingbrains.com
-
ukpms.com
-
livingstonemines.com
-
papeisonline.com
-
chrisbakerpr.com
-
omnipets.store
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2t9KtoR9xzpJY4E.exe"C:\Users\Admin\AppData\Local\Temp\2t9KtoR9xzpJY4E.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2t9KtoR9xzpJY4E.exe"C:\Users\Admin\AppData\Local\Temp\2t9KtoR9xzpJY4E.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\2t9KtoR9xzpJY4E.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2024-128-0x0000000002400000-0x000000000250B000-memory.dmp
memory/2024-133-0x0000000004F10000-0x0000000005070000-memory.dmp
memory/4196-119-0x0000000005570000-0x000000000560C000-memory.dmp
memory/4196-117-0x0000000005360000-0x00000000053F2000-memory.dmp
memory/4196-115-0x00000000009C0000-0x0000000000A98000-memory.dmp
memory/4196-120-0x00000000052C0000-0x00000000057BE000-memory.dmp
memory/4196-121-0x0000000005E80000-0x0000000005E8E000-memory.dmp
memory/4196-122-0x000000007E0D0000-0x000000007E0D1000-memory.dmp
memory/4196-123-0x0000000006270000-0x0000000006318000-memory.dmp
memory/4196-116-0x00000000057C0000-0x0000000005CBE000-memory.dmp
memory/4196-118-0x00000000052D0000-0x00000000052DA000-memory.dmp
memory/4652-127-0x00000000014F0000-0x0000000001685000-memory.dmp
memory/4652-126-0x0000000001830000-0x0000000001B50000-memory.dmp
memory/4652-124-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4704-129-0x0000000000B20000-0x0000000000B39000-memory.dmp
memory/4704-130-0x0000000002F70000-0x0000000002F99000-memory.dmp
memory/4704-131-0x0000000004F10000-0x0000000005230000-memory.dmp
memory/4704-132-0x0000000004D70000-0x0000000004F03000-memory.dmp