Analysis
- max time kernel
151s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
22/03/2022, 10:37
General
- Target 0OJZOa56I5JC3wS.exe
- Size 981KB
- Sample220322-mntmasehf2
- SHA256 b7abbe227ce2d0bb2c611e6e5b67e220261a5f2218ef18b22e3a794789cb1bfc
Malware Config
Extracted
-
xloader
-
2.5
-
iqof
-
downssandblasting.online
-
shopcongan.info
-
financeservicesolutions.com
-
ehiconao.com
-
15beverlydrive.com
-
happynize.net
-
findzx.net
-
kelly-peterson.xyz
-
datalign-exchange.com
-
kinemasterpro.pro
-
amage.agency
-
roleplayhr.com
-
movingikea.com
-
steinerikegeberg.com
-
nikolashadow.com
-
baumbestattung.net
-
mms12.xyz
-
cryptocurrencymarket.space
-
colt.business
-
neutralblocker.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Modifies data under HKEY_USERS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0OJZOa56I5JC3wS.exe"C:\Users\Admin\AppData\Local\Temp\0OJZOa56I5JC3wS.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0OJZOa56I5JC3wS.exe"C:\Users\Admin\AppData\Local\Temp\0OJZOa56I5JC3wS.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\0OJZOa56I5JC3wS.exe"3⤵
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1428-161-0x000001BF29920000-0x000001BF29921000-memory.dmp
memory/1428-156-0x000001BF2BED0000-0x000001BF2BED4000-memory.dmp
memory/1428-157-0x000001BF2BEB0000-0x000001BF2BEB1000-memory.dmp
memory/1428-158-0x000001BF2BC30000-0x000001BF2BC34000-memory.dmp
memory/1428-159-0x000001BF2BC20000-0x000001BF2BC21000-memory.dmp
memory/1428-160-0x000001BF2BC20000-0x000001BF2BC24000-memory.dmp
memory/1428-140-0x000001BF28D80000-0x000001BF28D90000-memory.dmp
memory/1428-141-0x000001BF29820000-0x000001BF29830000-memory.dmp
memory/1428-142-0x000001BF2BC00000-0x000001BF2BC04000-memory.dmp
memory/2860-138-0x0000000005B30000-0x0000000005B3A000-memory.dmp
memory/2860-143-0x00000000091F0000-0x000000000928C000-memory.dmp
memory/2860-139-0x00000000059A0000-0x0000000005F44000-memory.dmp
memory/2860-134-0x0000000000F00000-0x0000000000FFC000-memory.dmp
memory/2860-137-0x00000000059A0000-0x0000000005A32000-memory.dmp
memory/2860-136-0x0000000005F50000-0x00000000064F4000-memory.dmp
memory/2860-135-0x00000000746C0000-0x0000000074E70000-memory.dmp
memory/3024-155-0x00000000083C0000-0x0000000008537000-memory.dmp
memory/3024-150-0x00000000082C0000-0x00000000083B1000-memory.dmp
memory/4476-148-0x000000000041D000-0x000000000041E000-memory.dmp
memory/4476-149-0x0000000001740000-0x0000000001751000-memory.dmp
memory/4476-147-0x00000000012F0000-0x000000000163A000-memory.dmp
memory/4476-146-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4476-144-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4508-154-0x0000000000C60000-0x0000000000CF0000-memory.dmp
memory/4508-153-0x0000000000DC0000-0x000000000110A000-memory.dmp
memory/4508-152-0x0000000000340000-0x0000000000369000-memory.dmp
memory/4508-151-0x0000000000A50000-0x0000000000A5B000-memory.dmp