Analysis
- max time kernel
153s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
14/03/2022, 12:11
General
- Target PO0530322.exe
- Size 828KB
- Sample220314-pcltesfag5
- SHA256 511cfaacb35df2a07aca55efb2b27b6a557e210cb5ae1d31914336f39fc472e8
Malware Config
Extracted
-
xloader
-
2.5
-
emn5
-
clayexoticsatl.com
-
nezano.com
-
canacomagdalena.com
-
albawardl.com
-
dayinsuzhou.com
-
systdz.com
-
medievaliasabadell.com
-
brentkharper.store
-
aanvullend-protocol.xyz
-
ritebet388.com
-
kawaiim.com
-
laxwild.com
-
ilovemakingwebsites.com
-
joindowntown.com
-
car-tech.tech
-
ashcm.com
-
kryptolawyers.com
-
atasteofcali.com
-
isiachalsie.quest
-
marthaperry.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO0530322.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1672-130-0x0000000000730000-0x0000000000804000-memory.dmp
memory/1672-131-0x00000000057A0000-0x0000000005D44000-memory.dmp
memory/1672-132-0x0000000074F60000-0x0000000075710000-memory.dmp
memory/1672-133-0x00000000051F0000-0x0000000005282000-memory.dmp
memory/1672-134-0x0000000005390000-0x000000000539A000-memory.dmp
memory/1672-135-0x00000000051F0000-0x0000000005794000-memory.dmp
memory/1672-136-0x00000000090D0000-0x000000000916C000-memory.dmp
memory/2712-147-0x0000000008440000-0x000000000853B000-memory.dmp
memory/2712-152-0x0000000007CE0000-0x0000000007DA5000-memory.dmp
memory/2712-140-0x0000000008340000-0x000000000843C000-memory.dmp
memory/4076-146-0x0000000001690000-0x00000000016A1000-memory.dmp
memory/4076-142-0x000000000041D000-0x000000000041E000-memory.dmp
memory/4076-143-0x0000000001630000-0x0000000001641000-memory.dmp
memory/4076-145-0x000000000041D000-0x000000000041E000-memory.dmp
memory/4076-139-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4076-137-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4076-141-0x00000000016D0000-0x0000000001A1A000-memory.dmp
memory/4856-148-0x0000000000220000-0x0000000000247000-memory.dmp
memory/4856-149-0x00000000003A0000-0x00000000003C9000-memory.dmp
memory/4856-150-0x00000000025B0000-0x00000000028FA000-memory.dmp
memory/4856-151-0x00000000023C0000-0x0000000002450000-memory.dmp