Analysis
- max time kernel
89s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
24/02/2022, 08:57
General
- Target dec61c40661c7a5b70eab12cfead3e70.exe
- Size 15KB
- Sample220224-kwlkjsced6
- SHA256 eafdcbea5a9544d87f8a7c03ee4eb6ab0d9c12bbbbc1d9705dc94d5fd983c5bd
Malware Config
Extracted
-
xloader
-
2.5
-
b80i
-
yixuan5.com
-
jiazheng369.com
-
danielleefelipe.net
-
micorgas.com
-
uvywah.com
-
nbjcgl.com
-
streets4suites.com
-
hempgotas.com
-
postmoon.xyz
-
gaboshoes.com
-
pastodwes.com
-
libes.asia
-
damusalama.com
-
youngliving1.com
-
mollyagee.com
-
branchwallet.com
-
seebuehnegoerlitz.com
-
inventors.community
-
teentykarm.quest
-
927291.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Downloads MZ/PE file
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dec61c40661c7a5b70eab12cfead3e70.exe"C:\Users\Admin\AppData\Local\Temp\dec61c40661c7a5b70eab12cfead3e70.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dec61c40661c7a5b70eab12cfead3e70.exe"C:\Users\Admin\AppData\Local\Temp\dec61c40661c7a5b70eab12cfead3e70.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2316-130-0x000000007479E000-0x000000007479F000-memory.dmp
memory/2316-131-0x0000000000CD0000-0x0000000000CDA000-memory.dmp
memory/2316-132-0x0000000005BF0000-0x0000000006194000-memory.dmp
memory/2316-133-0x00000000056E0000-0x0000000005772000-memory.dmp
memory/2316-134-0x00000000058F0000-0x00000000058F1000-memory.dmp
memory/2316-135-0x0000000006A80000-0x0000000006B1C000-memory.dmp
memory/2836-136-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2836-137-0x0000000001420000-0x000000000176A000-memory.dmp