Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
31/01/2022, 15:24
General
- Target DHL Delivery Documents.exe
- Size 78KB
- Sample220131-ss4wqaabc3
- SHA256 b34bc888551b9a603edf76a356a4c0fc290fac420d3c6df0decd0916970bfb9b
Malware Config
Extracted
-
xloader
-
2.5
-
zqzw
-
laurentmathieu.com
-
nohohonndana.com
-
hhmc.info
-
shophallows.com
-
blazebunk.com
-
goodbridge.xyz
-
flakycloud.com
-
bakermckenziegroups.com
-
formation-adistance.com
-
lovingearthbotanicals.com
-
tbrservice.plus
-
heritagehousehotels.com
-
drwbuildersco.com
-
lacsghb.com
-
wain3x.com
-
dadreview.club
-
continiutycp.com
-
cockgirls.com
-
48mpt.xyz
-
033skz.xyz
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Delivery Documents.exe"C:\Users\Admin\AppData\Local\Temp\DHL Delivery Documents.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/564-60-0x00000000009C0000-0x0000000000CC3000-memory.dmp
memory/564-58-0x0000000000400000-0x0000000000429000-memory.dmp
memory/564-61-0x00000000001D0000-0x00000000001E1000-memory.dmp
memory/564-56-0x0000000000400000-0x0000000000429000-memory.dmp
memory/564-57-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1172-66-0x0000000001CA0000-0x0000000001D30000-memory.dmp
memory/1172-63-0x000000004A740000-0x000000004A78C000-memory.dmp
memory/1172-64-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/1172-65-0x0000000001F70000-0x0000000002273000-memory.dmp
memory/1384-62-0x0000000004730000-0x00000000047FA000-memory.dmp
memory/1384-67-0x0000000006940000-0x0000000006A60000-memory.dmp
memory/1720-53-0x000000013FC90000-0x000000013FCA8000-memory.dmp
memory/1720-54-0x000000001BE00000-0x000000001BE02000-memory.dmp
memory/1720-55-0x00000000020F0000-0x0000000002106000-memory.dmp