Analysis
- max time kernel
156s - max time network
165s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
21/02/2022, 12:26
General
- Target aUzTNhGt8rxnyMr.exe
- Size 732KB
- Sample220221-pl7r9abbgm
- SHA256 e649ef1ecf0e0daefe140fa78271435271c8d55607f8365ddef4d94b66bfdfdd
Malware Config
Extracted
-
xloader
-
2.5
-
icun
-
cushionfuid.com
-
nault.biz
-
blackeyesystem.com
-
cloudbreak.info
-
fengxueshe.xyz
-
raxzrecords.com
-
shjedu.com
-
ai-vacancy.online
-
bittigibi.com
-
trabajaencasa.xyz
-
afjdisposal.com
-
aboutrealestatenewyork.com
-
vinomartin.com
-
u0biitep9.xyz
-
mayoreomaskking.com
-
ammastone.com
-
windrowpklnmf.xyz
-
baznasdumai.com
-
campusodontologia.online
-
viciouspor.xyz
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Windows directory 6 IoCs
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aUzTNhGt8rxnyMr.exe"C:\Users\Admin\AppData\Local\Temp\aUzTNhGt8rxnyMr.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aUzTNhGt8rxnyMr.exe"C:\Users\Admin\AppData\Local\Temp\aUzTNhGt8rxnyMr.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\aUzTNhGt8rxnyMr.exe"3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2528-136-0x0000024E8F940000-0x0000024E8F950000-memory.dmp
memory/2528-137-0x0000024E8F9A0000-0x0000024E8F9B0000-memory.dmp
memory/2528-138-0x0000024E926C0000-0x0000024E926C4000-memory.dmp
memory/2536-149-0x0000000002610000-0x00000000026A0000-memory.dmp
memory/2536-148-0x0000000002870000-0x0000000002BBA000-memory.dmp
memory/2536-147-0x0000000000600000-0x0000000000629000-memory.dmp
memory/2536-146-0x0000000000FC0000-0x00000000010FA000-memory.dmp
memory/2600-145-0x0000000002730000-0x00000000027F0000-memory.dmp
memory/2600-150-0x0000000002A60000-0x0000000002BCE000-memory.dmp
memory/4364-140-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4364-142-0x00000000015E0000-0x000000000192A000-memory.dmp
memory/4364-143-0x000000000041D000-0x000000000041E000-memory.dmp
memory/4364-144-0x0000000001170000-0x0000000001181000-memory.dmp
memory/4612-130-0x00000000743EE000-0x00000000743EF000-memory.dmp
memory/4612-139-0x00000000074E0000-0x000000000757C000-memory.dmp
memory/4612-135-0x00000000050D0000-0x00000000050DA000-memory.dmp
memory/4612-134-0x0000000005320000-0x0000000005321000-memory.dmp
memory/4612-133-0x00000000050E0000-0x0000000005172000-memory.dmp
memory/4612-132-0x00000000057B0000-0x0000000005D54000-memory.dmp
memory/4612-131-0x00000000007B0000-0x000000000086E000-memory.dmp