Analysis
- max time kernel
153s - max time network
151s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
31/01/2022, 12:13
General
- Target Page-1029382393.exe
- Size 480KB
- Sample220131-pdrq3ahbbk
- SHA256 547b0c2f7b3ee0275ff34781d0fa579a07d437629c9ee5e81d8782bb7e12dc4e
Malware Config
Extracted
-
xloader
-
2.5
-
c6si
-
tristateinc.construction
-
americanscaregroundstexas.com
-
kanimisoshiru.com
-
wihling.com
-
fishcheekstosa.com
-
parentsfuid.com
-
greenstandmarket.com
-
fc8fla8kzq.com
-
gametwist-83.club
-
jobsncvs.com
-
directrealtysells.com
-
avida2015.com
-
conceptasite.net
-
arkaneattire.com
-
indev-mobility.info
-
2160centurypark412.com
-
valefloor.com
-
septembership.com
-
stackflix.com
-
jimc0sales.net
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe"C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe"C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/384-59-0x0000000000400000-0x0000000000429000-memory.dmp
memory/384-64-0x0000000000460000-0x0000000000471000-memory.dmp
memory/384-62-0x0000000000700000-0x0000000000A03000-memory.dmp
memory/384-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/384-60-0x0000000000400000-0x0000000000429000-memory.dmp
memory/568-67-0x00000000000F0000-0x0000000000119000-memory.dmp
memory/568-66-0x00000000008B0000-0x00000000008BB000-memory.dmp
memory/568-68-0x0000000001E50000-0x0000000002153000-memory.dmp
memory/568-69-0x0000000001D60000-0x0000000001DF0000-memory.dmp
memory/940-58-0x00000000048A0000-0x00000000048FE000-memory.dmp
memory/940-57-0x0000000004860000-0x0000000004861000-memory.dmp
memory/940-56-0x0000000000590000-0x00000000005A4000-memory.dmp
memory/940-55-0x0000000076121000-0x0000000076123000-memory.dmp
memory/940-54-0x0000000000D60000-0x0000000000DDE000-memory.dmp
memory/1380-65-0x0000000004AD0000-0x0000000004B97000-memory.dmp
memory/1380-70-0x0000000006500000-0x0000000006617000-memory.dmp