Analysis
- max time kernel
122s - max time network
128s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
24/02/2022, 08:57
General
- Target dec61c40661c7a5b70eab12cfead3e70.exe
- Size 15KB
- Sample220224-kwlkjsced6
- SHA256 eafdcbea5a9544d87f8a7c03ee4eb6ab0d9c12bbbbc1d9705dc94d5fd983c5bd
Malware Config
Extracted
-
xloader
-
2.5
-
b80i
-
yixuan5.com
-
jiazheng369.com
-
danielleefelipe.net
-
micorgas.com
-
uvywah.com
-
nbjcgl.com
-
streets4suites.com
-
hempgotas.com
-
postmoon.xyz
-
gaboshoes.com
-
pastodwes.com
-
libes.asia
-
damusalama.com
-
youngliving1.com
-
mollyagee.com
-
branchwallet.com
-
seebuehnegoerlitz.com
-
inventors.community
-
teentykarm.quest
-
927291.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Downloads MZ/PE file
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dec61c40661c7a5b70eab12cfead3e70.exe"C:\Users\Admin\AppData\Local\Temp\dec61c40661c7a5b70eab12cfead3e70.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dec61c40661c7a5b70eab12cfead3e70.exe"C:\Users\Admin\AppData\Local\Temp\dec61c40661c7a5b70eab12cfead3e70.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/992-59-0x0000000000400000-0x0000000000429000-memory.dmp
memory/992-60-0x0000000000400000-0x0000000000429000-memory.dmp
memory/992-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/992-62-0x0000000000930000-0x0000000000C33000-memory.dmp
memory/1192-55-0x000000007445E000-0x000000007445F000-memory.dmp
memory/1192-56-0x0000000000EC0000-0x0000000000ECA000-memory.dmp
memory/1192-57-0x0000000004F50000-0x0000000004F51000-memory.dmp
memory/1192-58-0x0000000000CE0000-0x0000000000D14000-memory.dmp