Analysis
- max time kernel
150s - max time network
146s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
02/03/2022, 19:33
General
- Target 21673a4749aeeabb4fa393b40b31f5c7.exe
- Size 308KB
- Sample220302-x9h3sshfgk
- SHA256 736e922d451686797ec76431a5c40aab65da4cc9de49fc8a898c013f44caf2ce
Malware Config
Extracted
-
xloader
-
2.5
-
y329
-
chatbotcop.com
-
869771.com
-
gnafleet.com
-
ktnanswer.xyz
-
shawtopia.com
-
henrycomms.com
-
galwayaccounting.com
-
shootingstarspix.com
-
stronghal.com
-
xammtdn.com
-
enfermerabilingue.biz
-
szbnp.com
-
toyota-fr.online
-
gorgeoussignals.com
-
anytimemoney.online
-
oneupcap.net
-
shieldhomeservice.com
-
thefss.online
-
vinnyvee.com
-
dailyblackcoffee.club
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 31 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\21673a4749aeeabb4fa393b40b31f5c7.exe"C:\Users\Admin\AppData\Local\Temp\21673a4749aeeabb4fa393b40b31f5c7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\usfcovems.exeC:\Users\Admin\AppData\Local\Temp\usfcovems.exe C:\Users\Admin\AppData\Local\Temp\rekdj2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\usfcovems.exeC:\Users\Admin\AppData\Local\Temp\usfcovems.exe C:\Users\Admin\AppData\Local\Temp\rekdj3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\usfcovems.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/460-65-0x000000000041D000-0x000000000041E000-memory.dmp
memory/460-69-0x000000000041D000-0x000000000041E000-memory.dmp
memory/460-64-0x0000000000A40000-0x0000000000D43000-memory.dmp
memory/460-70-0x0000000000210000-0x0000000000221000-memory.dmp
memory/460-66-0x0000000000110000-0x0000000000121000-memory.dmp
memory/460-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/460-68-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1040-72-0x00000000009E0000-0x0000000000A02000-memory.dmp
memory/1040-73-0x0000000000070000-0x0000000000099000-memory.dmp
memory/1040-74-0x0000000001FA0000-0x00000000022A3000-memory.dmp
memory/1040-75-0x0000000000900000-0x0000000000990000-memory.dmp
memory/1372-67-0x0000000006A20000-0x0000000006BAF000-memory.dmp
memory/1372-71-0x00000000071A0000-0x0000000007319000-memory.dmp
memory/1372-76-0x0000000008E80000-0x0000000008FD4000-memory.dmp
memory/1520-54-0x0000000076371000-0x0000000076373000-memory.dmp