Analysis
- max time kernel
158s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
21/03/2022, 08:31
General
- Target TNT Receipt_TNTMX988653000.exe
- Size 1.1MB
- Sample220321-kerp8saec6
- SHA256 c86f3a2110ed2a8498cf30d4ab88cf9ea18edc612835fe2b369e7596dafb802e
Malware Config
Extracted
-
xloader
-
2.5
-
sj8q
-
pickvector.net
-
adzaaulia.com
-
greydom.xyz
-
cluplife.com
-
mysticplanet.net
-
toppsbyfanatics.com
-
deliveryguys.club
-
bessbessie.top
-
trustpi.com
-
munda5.com
-
hunnidcentcotton.com
-
totalhomesroofing.com
-
psicrosslake.com
-
mk1232.com
-
kreditineskorteleslt.com
-
peblish.com
-
honobono-kobo.com
-
belovedvagabond.com
-
umityasarengin.com
-
heinousas.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TNT Receipt_TNTMX988653000.exe"C:\Users\Admin\AppData\Local\Temp\TNT Receipt_TNTMX988653000.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TNT Receipt_TNTMX988653000.exe"C:\Users\Admin\AppData\Local\Temp\TNT Receipt_TNTMX988653000.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\TNT Receipt_TNTMX988653000.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1460-145-0x0000000000310000-0x0000000000339000-memory.dmp
memory/1460-147-0x00000000013E0000-0x0000000001470000-memory.dmp
memory/1460-146-0x0000000001000000-0x000000000134A000-memory.dmp
memory/1460-144-0x0000000000A10000-0x0000000000A1E000-memory.dmp
memory/2004-131-0x00000000743E0000-0x0000000074B90000-memory.dmp
memory/2004-132-0x0000000005CA0000-0x0000000006244000-memory.dmp
memory/2004-133-0x00000000057D0000-0x0000000005862000-memory.dmp
memory/2004-134-0x0000000005880000-0x000000000588A000-memory.dmp
memory/2004-135-0x00000000056F0000-0x0000000005C94000-memory.dmp
memory/2004-136-0x0000000007FE0000-0x000000000807C000-memory.dmp
memory/2004-130-0x0000000000D10000-0x0000000000E26000-memory.dmp
memory/2284-139-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2284-142-0x0000000001250000-0x0000000001261000-memory.dmp
memory/2284-141-0x000000000041D000-0x000000000041E000-memory.dmp
memory/2284-140-0x0000000001700000-0x0000000001A4A000-memory.dmp
memory/2284-137-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2600-143-0x0000000002A60000-0x0000000002B7D000-memory.dmp
memory/2600-148-0x0000000002730000-0x00000000027DD000-memory.dmp