Analysis
- max time kernel
157s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
07/03/2022, 14:20
General
- Target PO 42746 VINNIC.exe
- Size 831KB
- Sample220307-rnfsnaabfn
- SHA256 c7c0d3e8cd6fb36ceb4b5c2e32b019dd209fdd38fdf1bcb215f973da80437dd8
Malware Config
Extracted
-
xloader
-
2.5
-
k4cp
-
comfytests.com
-
villanovas.com
-
649251.com
-
s-gis.com
-
envisiongaragedoor.com
-
studentpair.com
-
medflex.center
-
watxo.com
-
lewishead.com
-
thebrookkebabs.online
-
waleeddabash.com
-
seamenax.com
-
dalingtao.xyz
-
rosadotaco.com
-
tenlog058.xyz
-
newsmmpanel.xyz
-
okmakers.com
-
khokhoruislip.com
-
chanceriordan.com
-
cerityswag.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 50 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 42746 VINNIC.exe"C:\Users\Admin\AppData\Local\Temp\PO 42746 VINNIC.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2412-141-0x0000000007B70000-0x0000000007C8C000-memory.dmp
memory/2412-146-0x0000000007C90000-0x0000000007DE4000-memory.dmp
memory/2768-135-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/2768-136-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/2768-137-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/2768-139-0x000000007249D000-0x000000007249E000-memory.dmp
memory/2768-140-0x00000000030A0000-0x00000000030B1000-memory.dmp
memory/2768-138-0x0000000004D40000-0x000000000508A000-memory.dmp
memory/3764-143-0x0000000002A70000-0x0000000002A99000-memory.dmp
memory/3764-142-0x0000000000660000-0x00000000006B7000-memory.dmp
memory/3764-144-0x0000000004C70000-0x0000000004FBA000-memory.dmp
memory/3764-145-0x0000000004820000-0x00000000048B0000-memory.dmp
memory/3884-130-0x0000000002270000-0x0000000002271000-memory.dmp
memory/3884-134-0x0000000003DE6000-0x0000000003DE7000-memory.dmp
memory/3884-131-0x0000000000400000-0x00000000004D5000-memory.dmp