Analysis
- max time kernel
4294190s - max time network
127s - platform
windows7_x64 - resource
win7-20220310-en - submitted
14/03/2022, 15:01
General
- Target LSP140322.exe
- Size 924KB
- Sample220314-sdwlssageq
- SHA256 90b9df6a803fce475920ccd036a647601a8f65bec5a7a9bbdd59a86b4bf004bf
Malware Config
Extracted
-
xloader
-
2.5
-
ahc8
-
192451.com
-
wwwripostes.net
-
sirikhalsalaw.com
-
bitterbaybay.com
-
stella-scrubs.com
-
almanecermezcal.com
-
goodgood.online
-
translate-now.online
-
sincerefilm.com
-
quadrantforensics.com
-
johnfrenchart.com
-
plick-click.com
-
alnileen.com
-
tghi.xyz
-
172711.com
-
maymakita.com
-
punnyaseva.com
-
ukash-online.com
-
sho-yururi-blog.com
-
hebergement-solidaire.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LSP140322.exe"C:\Users\Admin\AppData\Local\Temp\LSP140322.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LSP140322.exe"C:\Users\Admin\AppData\Local\Temp\LSP140322.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1104-54-0x0000000073E00000-0x00000000744EE000-memory.dmp
memory/1104-55-0x00000000008C0000-0x00000000009AE000-memory.dmp
memory/1104-56-0x0000000004720000-0x0000000004721000-memory.dmp
memory/1104-57-0x0000000000800000-0x000000000081A000-memory.dmp
memory/1104-58-0x0000000004FB0000-0x0000000005066000-memory.dmp
memory/1104-59-0x0000000004100000-0x0000000004136000-memory.dmp
memory/1924-60-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1924-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1924-64-0x0000000000400000-0x0000000000429000-memory.dmp