Analysis
- max time kernel
118s - max time network
118s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
27/01/2022, 14:55
General
- Target 2f7c9029b930382a47dc1559e4127d78.exe
- Size 387KB
- Sample220127-sagcpsfad6
- SHA256 32fea88907cbefd31749cedfc8b85d3775fca2f65b15594dde355624b3ad7cc8
Malware Config
Extracted
-
xloader
-
2.5
-
i5nb
-
monkenram.com
-
ryhairclinic.com
-
smtrbrndmethod.com
-
skvela-plet.com
-
1sa.space
-
duplicatedaves.com
-
tudesafiofit.com
-
stolenartnfts.com
-
htmconfeccoes.com
-
popitparadise.com
-
brightlightservices.net
-
restaurangveckan.one
-
yourlittlehelp.store
-
vsley.com
-
xxxpornmodels.com
-
lei.ink
-
ouch247tap.com
-
paradgmpharma.com
-
airdrop-binance.com
-
hip-hopyhvqha.online
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f7c9029b930382a47dc1559e4127d78.exe"C:\Users\Admin\AppData\Local\Temp\2f7c9029b930382a47dc1559e4127d78.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2f7c9029b930382a47dc1559e4127d78.exe"C:\Users\Admin\AppData\Local\Temp\2f7c9029b930382a47dc1559e4127d78.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3336-115-0x0000000000880000-0x00000000008E8000-memory.dmp
memory/3336-116-0x0000000005710000-0x0000000005C0E000-memory.dmp
memory/3336-117-0x0000000005140000-0x00000000051D2000-memory.dmp
memory/3336-118-0x0000000005110000-0x000000000511A000-memory.dmp
memory/3336-119-0x0000000005370000-0x000000000537C000-memory.dmp
memory/3336-120-0x0000000005210000-0x000000000570E000-memory.dmp
memory/3336-121-0x0000000007830000-0x00000000078CC000-memory.dmp
memory/3336-122-0x0000000007AB0000-0x0000000007B12000-memory.dmp
memory/4292-123-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4292-124-0x0000000001410000-0x0000000001730000-memory.dmp