Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
10/03/2022, 05:50
General
- Target payment swift.exe
- Size 798KB
- Sample220310-gjm13aecb3
- SHA256 a7655f6638eabfbb8f8f1f2a1a06a3c7c548791e39587b0b9b8aaff68f5b8e5a
Malware Config
Extracted
-
xloader
-
2.5
-
yrcy
-
sturlabas.com
-
tantrungcompany.com
-
wildgraceyogahealing.com
-
wsparalegal.com
-
8xhgq.xyz
-
mysaylav.com
-
amelntl.net
-
cooleshow.online
-
adventuresbydisneyathome.com
-
sprinklekart.com
-
prostitutkitambovasuck.info
-
pakdao.com
-
finsith.com
-
nightpartner82.xyz
-
sex9a4ufbj.com
-
ketohousee.com
-
mairie-les-cammazes.com
-
elebots.xyz
-
highqualityremodeling.net
-
teamsterslocal553.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payment swift.exe"C:\Users\Admin\AppData\Local\Temp\payment swift.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2440-142-0x0000000007820000-0x00000000079B2000-memory.dmp
memory/2440-147-0x00000000079C0000-0x0000000007B08000-memory.dmp
memory/3080-131-0x0000000000790000-0x000000000085E000-memory.dmp
memory/3080-132-0x0000000005850000-0x0000000005DF4000-memory.dmp
memory/3080-133-0x00000000051F0000-0x0000000005282000-memory.dmp
memory/3080-134-0x00000000053A0000-0x00000000053AA000-memory.dmp
memory/3080-135-0x00000000052A0000-0x0000000005844000-memory.dmp
memory/3080-136-0x00000000077E0000-0x000000000787C000-memory.dmp
memory/3080-130-0x0000000074CF0000-0x00000000754A0000-memory.dmp
memory/3428-144-0x00000000001B0000-0x00000000001D9000-memory.dmp
memory/3428-143-0x0000000000650000-0x0000000000666000-memory.dmp
memory/3428-145-0x0000000004310000-0x000000000465A000-memory.dmp
memory/3428-146-0x0000000004170000-0x0000000004200000-memory.dmp
memory/3660-141-0x0000000000AF0000-0x0000000000B01000-memory.dmp
memory/3660-140-0x000000000041D000-0x000000000041E000-memory.dmp
memory/3660-139-0x0000000000F80000-0x00000000012CA000-memory.dmp
memory/3660-137-0x0000000000400000-0x0000000000429000-memory.dmp