Analysis
- max time kernel
157s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
15/03/2022, 08:44
General
- Target New_PO_#YIBHC3892900114-03-2022_Evaluated Copy.exe
- Size 683KB
- Sample220315-km7reshcc2
- SHA256 8db76bfdd2666649dc2be8ef188d9548971f1edbe4d45c0d689a4700f7ff8169
Malware Config
Extracted
-
xloader
-
2.5
-
asfv
-
resonantenergytherapy.com
-
funnybunnyfoods.com
-
qianfawu.com
-
g2f3.xyz
-
myqekus.xyz
-
aureliasocial.com
-
inoteapp.com
-
listukerfo.quest
-
jldhsmy.com
-
028display.com
-
verdantpor.xyz
-
masteringfundamentals.com
-
myhomedelights.com
-
joy-one.xyz
-
appmust.store
-
shopium.net
-
getitfasttrucking.com
-
christiancoachingforkids.com
-
whitneyswagon.com
-
julesanne.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New_PO_#YIBHC3892900114-03-2022_Evaluated Copy.exe"C:\Users\Admin\AppData\Local\Temp\New_PO_#YIBHC3892900114-03-2022_Evaluated Copy.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Codgldht.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\CodgldhO.bat4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet session5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session6⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3060-170-0x00000000092F0000-0x0000000009429000-memory.dmp
memory/3060-147-0x0000000008C00000-0x0000000008D83000-memory.dmp
memory/3640-137-0x00000000037E6000-0x00000000037E7000-memory.dmp
memory/3640-134-0x0000000000670000-0x0000000000671000-memory.dmp
memory/4216-146-0x0000000002820000-0x0000000002831000-memory.dmp
memory/4216-145-0x000000007249D000-0x000000007249E000-memory.dmp
memory/4216-144-0x00000000029B0000-0x0000000002CFA000-memory.dmp
memory/4216-143-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/4216-142-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/4216-141-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/4540-168-0x0000000002870000-0x0000000002900000-memory.dmp
memory/4540-158-0x0000000002A40000-0x0000000002D8A000-memory.dmp
memory/4540-156-0x00000000006C0000-0x00000000006D9000-memory.dmp
memory/4540-157-0x0000000000960000-0x0000000000989000-memory.dmp
memory/5024-154-0x00000000059D0000-0x0000000005A36000-memory.dmp
memory/5024-164-0x000000007F540000-0x000000007F541000-memory.dmp
memory/5024-155-0x0000000005A40000-0x0000000005AA6000-memory.dmp
memory/5024-152-0x00000000053A0000-0x00000000059C8000-memory.dmp
memory/5024-151-0x0000000002860000-0x0000000002861000-memory.dmp
memory/5024-150-0x0000000002862000-0x0000000002863000-memory.dmp
memory/5024-159-0x0000000006030000-0x000000000604E000-memory.dmp
memory/5024-160-0x0000000002865000-0x0000000002867000-memory.dmp
memory/5024-161-0x0000000006680000-0x00000000066B2000-memory.dmp
memory/5024-162-0x000000006F3A0000-0x000000006F3EC000-memory.dmp
memory/5024-163-0x0000000006640000-0x000000000665E000-memory.dmp
memory/5024-153-0x0000000005200000-0x0000000005222000-memory.dmp
memory/5024-165-0x0000000007A50000-0x00000000080CA000-memory.dmp
memory/5024-166-0x00000000070D0000-0x00000000070EA000-memory.dmp
memory/5024-149-0x0000000072B50000-0x0000000073300000-memory.dmp
memory/5024-167-0x0000000007410000-0x000000000741A000-memory.dmp
memory/5024-169-0x0000000007600000-0x0000000007696000-memory.dmp
memory/5024-148-0x0000000002C30000-0x0000000002C66000-memory.dmp
memory/5024-171-0x00000000075C0000-0x00000000075CE000-memory.dmp
memory/5024-172-0x00000000076C0000-0x00000000076DA000-memory.dmp
memory/5024-173-0x00000000076B0000-0x00000000076B8000-memory.dmp