Analysis
- max time kernel
151s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
01/03/2022, 09:25
General
- Target 8771a231ceb9676bcfe954442c26581e.exe
- Size 791KB
- Sample220301-ldmwbsheb2
- SHA256 a8d57222d66a26a6ef7fe2d8eeb11a8af7ea9693afcbb31eece3519379c07784
Malware Config
Extracted
-
xloader
-
2.5
-
arh2
-
anniversaryalert.com
-
kinship.space
-
buabdullagroup.com
-
ghostprotectionagency.com
-
scion-go-getter.com
-
skindeepapp.com
-
kysp3.xyz
-
bonitaspringshomesearch.com
-
bestdeals2022.online
-
themarketingstinger.com
-
chengkayouxuan.com
-
fendoremi.com
-
j-stra.com
-
klingelecn.net
-
deluxecarepro.com
-
huanbaodg.com
-
mes-dents-blanches.com
-
solutionsemissionsimplifiee.com
-
abedbashir.tech
-
good-collection.store
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8771a231ceb9676bcfe954442c26581e.exe"C:\Users\Admin\AppData\Local\Temp\8771a231ceb9676bcfe954442c26581e.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\runonce.exe"C:\Windows\SysWOW64\runonce.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\runonce.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1492-130-0x0000000000680000-0x000000000074C000-memory.dmp
memory/1492-131-0x000000007477E000-0x000000007477F000-memory.dmp
memory/1492-132-0x00000000050F0000-0x000000000518C000-memory.dmp
memory/1492-133-0x0000000005740000-0x0000000005CE4000-memory.dmp
memory/1492-134-0x0000000005230000-0x00000000052C2000-memory.dmp
memory/1492-135-0x0000000005220000-0x0000000005221000-memory.dmp
memory/2392-138-0x0000000000CC0000-0x000000000100A000-memory.dmp
memory/2392-139-0x000000000041D000-0x000000000041E000-memory.dmp
memory/2392-136-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2392-140-0x0000000000690000-0x00000000006A1000-memory.dmp
memory/2688-141-0x00000000084A0000-0x000000000863D000-memory.dmp
memory/2688-146-0x0000000008640000-0x0000000008721000-memory.dmp
memory/3904-143-0x0000000001200000-0x0000000001229000-memory.dmp
memory/3904-142-0x0000000000410000-0x0000000000437000-memory.dmp
memory/3904-144-0x0000000003280000-0x00000000035CA000-memory.dmp
memory/3904-145-0x00000000030B0000-0x0000000003140000-memory.dmp