Analysis
- max time kernel
117s - max time network
117s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
27/01/2022, 14:55
General
- Target 2f7c9029b930382a47dc1559e4127d78.exe
- Size 387KB
- Sample220127-sagcpsfad6
- SHA256 32fea88907cbefd31749cedfc8b85d3775fca2f65b15594dde355624b3ad7cc8
Malware Config
Extracted
-
xloader
-
2.5
-
i5nb
-
monkenram.com
-
ryhairclinic.com
-
smtrbrndmethod.com
-
skvela-plet.com
-
1sa.space
-
duplicatedaves.com
-
tudesafiofit.com
-
stolenartnfts.com
-
htmconfeccoes.com
-
popitparadise.com
-
brightlightservices.net
-
restaurangveckan.one
-
yourlittlehelp.store
-
vsley.com
-
xxxpornmodels.com
-
lei.ink
-
ouch247tap.com
-
paradgmpharma.com
-
airdrop-binance.com
-
hip-hopyhvqha.online
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f7c9029b930382a47dc1559e4127d78.exe"C:\Users\Admin\AppData\Local\Temp\2f7c9029b930382a47dc1559e4127d78.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2f7c9029b930382a47dc1559e4127d78.exe"C:\Users\Admin\AppData\Local\Temp\2f7c9029b930382a47dc1559e4127d78.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/708-60-0x0000000000400000-0x0000000000429000-memory.dmp
memory/708-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/708-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/708-63-0x0000000000AA0000-0x0000000000DA3000-memory.dmp
memory/1212-55-0x0000000000190000-0x00000000001F8000-memory.dmp
memory/1212-56-0x0000000075D61000-0x0000000075D63000-memory.dmp
memory/1212-57-0x0000000001F10000-0x0000000001F11000-memory.dmp
memory/1212-58-0x0000000000690000-0x000000000069C000-memory.dmp
memory/1212-59-0x0000000004F70000-0x0000000004FD2000-memory.dmp