Analysis
- max time kernel
159s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
03/03/2022, 09:42
General
- Target fe19b1cca116f748b3f67788be824c73.exe
- Size 760KB
- Sample220303-lpcjqscbbj
- SHA256 988d086b6ca75da2fca905b090c6f20b21749335f7e2ee99d8dab2001d4667e3
Malware Config
Extracted
-
xloader
-
2.5
-
e3rs
-
padisarealtygroup.com
-
sagedermatology.com
-
drlonnrobertson.com
-
carlesabadtent.com
-
sophisticatedsignings.com
-
xn--laufgefhl-w9a.com
-
sutnsdmxq.icu
-
atasteofcal.com
-
ocvcoins.com
-
trakauto.quest
-
l2plusleft.com
-
in-cruise.online
-
ybappdl.com
-
county7.com
-
tenlog020.xyz
-
eventsweekend.net
-
zxzxmail.com
-
65backyard.com
-
sunnycraftsman.com
-
sailorswife.online
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fe19b1cca116f748b3f67788be824c73.exe"C:\Users\Admin\AppData\Local\Temp\fe19b1cca116f748b3f67788be824c73.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/920-139-0x000000007249D000-0x000000007249E000-memory.dmp
memory/920-140-0x0000000004590000-0x00000000045A1000-memory.dmp
memory/920-135-0x0000000000530000-0x0000000000531000-memory.dmp
memory/920-136-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/920-138-0x0000000004750000-0x0000000004A9A000-memory.dmp
memory/2440-141-0x0000000002C00000-0x0000000002D4A000-memory.dmp
memory/2440-146-0x00000000080D0000-0x00000000081FE000-memory.dmp
memory/3224-134-0x0000000003986000-0x0000000003987000-memory.dmp
memory/3224-130-0x0000000002260000-0x0000000002261000-memory.dmp
memory/3224-132-0x0000000000406000-0x0000000000407000-memory.dmp
memory/3716-145-0x00000000037E0000-0x0000000003870000-memory.dmp
memory/3716-144-0x0000000003AB0000-0x0000000003DFA000-memory.dmp
memory/3716-143-0x0000000000DF0000-0x0000000000E19000-memory.dmp
memory/3716-142-0x0000000000E80000-0x0000000000E9E000-memory.dmp