Analysis
- max time kernel
4294180s - max time network
124s - platform
windows7_x64 - resource
win7-20220311-en - submitted
22/03/2022, 18:49
General
- Target e91117a64646a3362796ec445df5ca4c.exe
- Size 964KB
- Sample220322-xgcejsgff2
- SHA256 cd8517b48008d82b4246f4fa0dee41f6510127486f8c1e24293174c794f35684
Malware Config
Extracted
-
xloader
-
2.5
-
dgrg
-
iot-vn.com
-
gamiteisnowjoyned.com
-
ak8flfqzm8.com
-
daliborkokic.com
-
mrk-9.com
-
tanzibkarate.quest
-
mburmtdvccti.mobi
-
thomas-wildlife-control.com
-
thebritenseries.com
-
hkkbags.com
-
redenyl.com
-
resilientbutterfly.com
-
nicethelab.com
-
xn--1lq90isray30ltdc.xn--czru2d
-
cyberews.net
-
naclepin2a.xyz
-
rodrigocoppa.com
-
hightings.com
-
chamaaibrasil.com
-
bdelsaer.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e91117a64646a3362796ec445df5ca4c.exe"C:\Users\Admin\AppData\Local\Temp\e91117a64646a3362796ec445df5ca4c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\secinit.exe"C:\Windows\SysWOW64\secinit.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1624-60-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1624-62-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1624-64-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1624-66-0x0000000000400000-0x000000000043A000-memory.dmp
memory/1808-54-0x0000000001280000-0x0000000001376000-memory.dmp
memory/1808-56-0x0000000004CF0000-0x0000000004CF1000-memory.dmp
memory/1808-55-0x0000000074E50000-0x000000007553E000-memory.dmp
memory/1808-57-0x0000000004E50000-0x0000000004F0C000-memory.dmp
memory/1808-58-0x0000000000AC0000-0x0000000000B10000-memory.dmp
memory/1808-59-0x0000000004CF5000-0x0000000004D06000-memory.dmp