Analysis
- max time kernel
148s - max time network
152s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
28/02/2022, 13:59
General
- Target INV15420.exe
- Size 42KB
- Sample220228-rad2xaedc3
- SHA256 109bfc4f1d73233b058db08b761ad7c77a7bc43bfe2b10a71614e536c2e89d3a
Malware Config
Extracted
-
xloader
-
2.5
-
ahc8
-
192451.com
-
wwwripostes.net
-
sirikhalsalaw.com
-
bitterbaybay.com
-
stella-scrubs.com
-
almanecermezcal.com
-
goodgood.online
-
translate-now.online
-
sincerefilm.com
-
quadrantforensics.com
-
johnfrenchart.com
-
plick-click.com
-
alnileen.com
-
tghi.xyz
-
172711.com
-
maymakita.com
-
punnyaseva.com
-
ukash-online.com
-
sho-yururi-blog.com
-
hebergement-solidaire.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Downloads MZ/PE file
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INV15420.exe"C:\Users\Admin\AppData\Local\Temp\INV15420.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INV15420.exe"C:\Users\Admin\AppData\Local\Temp\INV15420.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\INV15420.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/588-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/588-67-0x0000000000180000-0x0000000000191000-memory.dmp
memory/588-66-0x000000000041D000-0x000000000041E000-memory.dmp
memory/588-65-0x00000000008D0000-0x0000000000BD3000-memory.dmp
memory/588-64-0x0000000000400000-0x0000000000429000-memory.dmp
memory/588-60-0x0000000000400000-0x0000000000429000-memory.dmp
memory/588-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1372-68-0x0000000006A20000-0x0000000006B8E000-memory.dmp
memory/1372-73-0x0000000008D00000-0x0000000008E78000-memory.dmp
memory/1560-69-0x0000000000660000-0x0000000000665000-memory.dmp
memory/1560-70-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/1560-71-0x0000000002030000-0x0000000002333000-memory.dmp
memory/1560-72-0x0000000001D60000-0x0000000001DF0000-memory.dmp
memory/1560-74-0x0000000076371000-0x0000000076373000-memory.dmp
memory/1588-59-0x0000000000990000-0x0000000000998000-memory.dmp
memory/1588-58-0x00000000004D0000-0x00000000004E6000-memory.dmp
memory/1588-57-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
memory/1588-56-0x000000007445E000-0x000000007445F000-memory.dmp
memory/1588-55-0x00000000010E0000-0x00000000010F0000-memory.dmp