Analysis
- max time kernel
154s - max time network
165s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
17/02/2022, 05:54
General
- Target Swift copy payment.exe
- Size 837KB
- Sample220217-glw2rahga3
- SHA256 b5ca813a9176c8f6eb9394308c56858d9e27300f9c5a75c82eceae96b8defd83
Malware Config
Extracted
-
xloader
-
2.5
-
6dmq
-
christiealana.com
-
blogs.quest
-
canwasysce.com
-
0e1.biz
-
smart2b.online
-
piter.host
-
shravanti.com
-
1h2.space
-
whimsicalprinting.com
-
whippse.com
-
pillarbox-studio.art
-
yekanahtartuning.com
-
shopallaboutbaby.com
-
markarge.com
-
studio-orleen.com
-
rabinotis.quest
-
yuthukam.com
-
autosalesjax.info
-
medicestryllc.com
-
zip2me.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Swift copy payment.exe"C:\Users\Admin\AppData\Local\Temp\Swift copy payment.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Swift copy payment.exe"C:\Users\Admin\AppData\Local\Temp\Swift copy payment.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Swift copy payment.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/636-72-0x0000000001D80000-0x0000000001E10000-memory.dmp
memory/636-69-0x0000000000530000-0x000000000053D000-memory.dmp
memory/636-70-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/636-71-0x0000000001F30000-0x0000000002233000-memory.dmp
memory/804-57-0x0000000004A30000-0x0000000004A31000-memory.dmp
memory/804-59-0x0000000005260000-0x000000000530E000-memory.dmp
memory/804-60-0x00000000007A0000-0x00000000007D0000-memory.dmp
memory/804-54-0x0000000074B6E000-0x0000000074B6F000-memory.dmp
memory/804-58-0x0000000004A35000-0x0000000004A46000-memory.dmp
memory/804-56-0x00000000002A0000-0x00000000002AE000-memory.dmp
memory/804-55-0x00000000002C0000-0x0000000000398000-memory.dmp
memory/1276-73-0x0000000006AF0000-0x0000000006C57000-memory.dmp
memory/1276-68-0x0000000004D00000-0x0000000004DAF000-memory.dmp
memory/1648-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1648-65-0x00000000009F0000-0x0000000000CF3000-memory.dmp
memory/1648-66-0x000000000041D000-0x000000000041E000-memory.dmp
memory/1648-67-0x00000000001C0000-0x00000000001D1000-memory.dmp
memory/1648-63-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1648-61-0x0000000000400000-0x0000000000429000-memory.dmp