Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
21/03/2022, 11:44
General
- Target aaaaa.exe
- Size 1.0MB
- Sample220321-nv6e4scaej
- SHA256 6171e04c14e21039e5d518ea5b1129a09ac09d23f8c8169da89ba5fc7e816a35
Malware Config
Extracted
-
xloader
-
2.5
-
seic
-
7890166.com
-
tuwei.xn--6qq986b3xl
-
wulkan-slots.online
-
baileysepictravel.com
-
cheyiz.store
-
xo168.net
-
thecreditbuilder.company
-
prawoturystyki.com
-
studenttech.xyz
-
websitefast.online
-
qyhuli.com
-
tanujpackersmovers.com
-
arkhamchess.com
-
maxicashpromir.xyz
-
fuzvjy.com
-
xocontinued.com
-
exploitslozdz.xyz
-
outerverse.space
-
needsumo.com
-
kreativevisibility.net
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aaaaa.exe"C:\Users\Admin\AppData\Local\Temp\aaaaa.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/604-131-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/1296-137-0x0000000002840000-0x0000000002851000-memory.dmp
memory/1296-133-0x0000000000800000-0x0000000000801000-memory.dmp
memory/1296-134-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/1296-136-0x000000007249D000-0x000000007249E000-memory.dmp
memory/1296-135-0x0000000002A50000-0x0000000002D9A000-memory.dmp
memory/1296-132-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/1368-139-0x0000000000BE0000-0x0000000001013000-memory.dmp
memory/1368-140-0x0000000000AC0000-0x0000000000AE9000-memory.dmp
memory/1368-141-0x0000000003170000-0x00000000034BA000-memory.dmp
memory/1368-142-0x0000000002EA0000-0x0000000002F30000-memory.dmp
memory/2712-138-0x0000000002AB0000-0x0000000002BF9000-memory.dmp
memory/2712-143-0x0000000007C30000-0x0000000007D9B000-memory.dmp