Analysis
- max time kernel
150s - max time network
154s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
23/02/2022, 12:31
General
- Target 91JadopM6BYFF0K.exe
- Size 786KB
- Sample220223-pp2emsaaf5
- SHA256 9d144168607d4e6808be108cf349da625b911307dabab1ea645381a5473deb03
Malware Config
Extracted
-
xloader
-
2.5
-
wdc8
-
mygotomaid.com
-
joyoushealthandwellnessspa.com
-
wefundprojects.com
-
magicbasketbourse.net
-
vitos3.xyz
-
oligopoly.city
-
beauty-bihada.asia
-
visitnewrichmond.com
-
crgeniusworld.biz
-
bantasis.com
-
transsexual.pro
-
casagraph.com
-
eastjamrecords.com
-
howtotrainyourmustache.com
-
heiappropriate.xyz
-
bataperu.com
-
ces341.com
-
prajahitha.com
-
manuelagattegger.com
-
wolfpackmotorcycletours.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Blocklisted process makes network request 6 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\91JadopM6BYFF0K.exe"C:\Users\Admin\AppData\Local\Temp\91JadopM6BYFF0K.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\91JadopM6BYFF0K.exe"C:\Users\Admin\AppData\Local\Temp\91JadopM6BYFF0K.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\91JadopM6BYFF0K.exe"C:\Users\Admin\AppData\Local\Temp\91JadopM6BYFF0K.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\91JadopM6BYFF0K.exe"C:\Users\Admin\AppData\Local\Temp\91JadopM6BYFF0K.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\91JadopM6BYFF0K.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/828-72-0x0000000000820000-0x00000000008B0000-memory.dmp
memory/828-71-0x0000000000AF0000-0x0000000000DF3000-memory.dmp
memory/828-69-0x0000000000F20000-0x0000000000F2E000-memory.dmp
memory/828-70-0x0000000000090000-0x00000000000B9000-memory.dmp
memory/828-68-0x0000000076511000-0x0000000076513000-memory.dmp
memory/1356-67-0x0000000006B00000-0x0000000006C43000-memory.dmp
memory/1356-73-0x0000000006D90000-0x0000000006E5B000-memory.dmp
memory/1464-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1464-65-0x000000000041D000-0x000000000041E000-memory.dmp
memory/1464-64-0x0000000000A20000-0x0000000000D23000-memory.dmp
memory/1464-66-0x0000000000290000-0x00000000002A1000-memory.dmp
memory/1464-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1464-60-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1932-54-0x0000000074B4E000-0x0000000074B4F000-memory.dmp
memory/1932-59-0x0000000000880000-0x00000000008B0000-memory.dmp
memory/1932-58-0x0000000005330000-0x00000000053E0000-memory.dmp
memory/1932-57-0x0000000000670000-0x0000000000680000-memory.dmp
memory/1932-56-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
memory/1932-55-0x00000000010C0000-0x000000000118A000-memory.dmp