Analysis
- max time kernel
4294183s - max time network
129s - platform
windows7_x64 - resource
win7-20220311-en - submitted
14/03/2022, 09:12
General
- Target 1C7mNWnoqzhRHKC.exe
- Size 930KB
- Sample220314-k56xvaeac8
- SHA256 e321bd433e6e630bb69b21c80533446717274fd02eb74e74670934f5cc7e145c
Malware Config
Extracted
-
xloader
-
2.5
-
h85e
-
escvillage.com
-
planetacarballo.com
-
alexandercaron.com
-
yeslic.com
-
muckymitts.com
-
constructionsdhblais.com
-
1iheuz.cloud
-
jonathanandlola.info
-
quantumweave.com
-
flippingmetro.com
-
ledytj.com
-
tender.guru
-
icatercookouts.com
-
liegeart.com
-
ibizaeyewear.com
-
micrkindom.com
-
sorialab8.online
-
spiritueleonlinetraining.online
-
teguhbestari.com
-
areservice.center
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1C7mNWnoqzhRHKC.exe"C:\Users\Admin\AppData\Local\Temp\1C7mNWnoqzhRHKC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1C7mNWnoqzhRHKC.exe"C:\Users\Admin\AppData\Local\Temp\1C7mNWnoqzhRHKC.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1192-54-0x00000000001A0000-0x000000000028E000-memory.dmp
memory/1192-56-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
memory/1192-55-0x0000000074290000-0x000000007497E000-memory.dmp
memory/1192-57-0x00000000005B0000-0x00000000005CA000-memory.dmp
memory/1192-58-0x00000000080E0000-0x0000000008196000-memory.dmp
memory/1192-59-0x0000000001F40000-0x0000000001F76000-memory.dmp
memory/1672-60-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1672-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1672-64-0x0000000000400000-0x0000000000429000-memory.dmp