Analysis
- max time kernel
4294183s - max time network
125s - platform
windows7_x64 - resource
win7-20220311-en - submitted
21/03/2022, 16:04
General
- Target Telex release.exe
- Size 1.1MB
- Sample220321-thygmahdcj
- SHA256 85434cc29d28674a4e118cdbbee621656d1aa0b0507fd1135446c93e97d175be
Malware Config
Extracted
-
xloader
-
2.5
-
n8bs
-
monese-bank.com
-
silkypumps.xyz
-
tashabouvier.com
-
eduardoleonsilva.com
-
pinnaclecorporaterentals.com
-
megafluids.com
-
worldwidecarfans.com
-
benjamlnesq.com
-
unitedraxiapp.com
-
thetanheroes.com
-
jypmore.quest
-
indianasheriffs.biz
-
saintinstead.com
-
alldansmx.com
-
trulyproofreading.com
-
indotogel369.com
-
mermadekusse.store
-
radosenterprisellc.com
-
gseequalservices.com
-
techride.xyz
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Telex release.exe"C:\Users\Admin\AppData\Local\Temp\Telex release.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Telex release.exe"C:\Users\Admin\AppData\Local\Temp\Telex release.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/628-54-0x0000000000E30000-0x0000000000F50000-memory.dmp
memory/628-55-0x0000000074CE0000-0x00000000753CE000-memory.dmp
memory/628-56-0x00000000043D0000-0x00000000043D1000-memory.dmp
memory/628-57-0x0000000000500000-0x0000000000518000-memory.dmp
memory/628-58-0x00000000043D1000-0x00000000043D2000-memory.dmp
memory/628-59-0x00000000082C0000-0x00000000083B8000-memory.dmp
memory/628-60-0x0000000000AE0000-0x0000000000B10000-memory.dmp
memory/628-61-0x00000000043D6000-0x00000000043E7000-memory.dmp
memory/1012-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1012-66-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1012-64-0x0000000000400000-0x0000000000429000-memory.dmp