Analysis
- max time kernel
158s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
21/03/2022, 16:04
General
- Target Telex release.exe
- Size 1.1MB
- Sample220321-thygmahdcj
- SHA256 85434cc29d28674a4e118cdbbee621656d1aa0b0507fd1135446c93e97d175be
Malware Config
Extracted
-
xloader
-
2.5
-
n8bs
-
monese-bank.com
-
silkypumps.xyz
-
tashabouvier.com
-
eduardoleonsilva.com
-
pinnaclecorporaterentals.com
-
megafluids.com
-
worldwidecarfans.com
-
benjamlnesq.com
-
unitedraxiapp.com
-
thetanheroes.com
-
jypmore.quest
-
indianasheriffs.biz
-
saintinstead.com
-
alldansmx.com
-
trulyproofreading.com
-
indotogel369.com
-
mermadekusse.store
-
radosenterprisellc.com
-
gseequalservices.com
-
techride.xyz
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Telex release.exe"C:\Users\Admin\AppData\Local\Temp\Telex release.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Telex release.exe"C:\Users\Admin\AppData\Local\Temp\Telex release.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Telex release.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2216-142-0x0000000008090000-0x00000000081D0000-memory.dmp
memory/2216-147-0x0000000008390000-0x000000000845D000-memory.dmp
memory/2640-131-0x0000000005150000-0x00000000056F4000-memory.dmp
memory/2640-132-0x0000000004BA0000-0x0000000004C32000-memory.dmp
memory/2640-133-0x0000000074B60000-0x0000000075310000-memory.dmp
memory/2640-134-0x0000000004B30000-0x0000000004B3A000-memory.dmp
memory/2640-135-0x0000000004BA0000-0x0000000005144000-memory.dmp
memory/2640-136-0x00000000089A0000-0x0000000008A3C000-memory.dmp
memory/2640-130-0x0000000000070000-0x0000000000190000-memory.dmp
memory/4156-143-0x0000000000B20000-0x0000000000B2B000-memory.dmp
memory/4156-144-0x0000000000D40000-0x0000000000D69000-memory.dmp
memory/4156-145-0x0000000001720000-0x0000000001A6A000-memory.dmp
memory/4156-146-0x0000000001680000-0x0000000001710000-memory.dmp
memory/4168-141-0x0000000001D30000-0x0000000001D41000-memory.dmp
memory/4168-139-0x0000000001880000-0x0000000001BCA000-memory.dmp
memory/4168-140-0x000000000041D000-0x000000000041E000-memory.dmp
memory/4168-137-0x0000000000400000-0x0000000000429000-memory.dmp