Analysis
- max time kernel
4294180s - max time network
123s - platform
windows7_x64 - resource
win7-20220311-en - submitted
23/03/2022, 17:23
General
- Target copia_rapida.pdf.exe
- Size 950KB
- Sample220323-vx5d6adhem
- SHA256 39d7f0b102aca1db8c71a3a7af79ece2aa2100dbaf1c20237d75e36271833ef2
Malware Config
Extracted
-
xloader
-
2.5
-
uevb
-
red-tee.com
-
attention-arnaque.com
-
melissaposeyphotography.com
-
appgamblers.com
-
atlasarchitect.com
-
callbribe.com
-
expd8group.com
-
szlzhang.com
-
xuetian8899665.com
-
zonjebeir.com
-
chicoliftassit.com
-
santuariodelplomo.online
-
spearyard.com
-
deliciasnancy.com
-
immovda.net
-
vfuhgerguy.store
-
tb4.xyz
-
buystructured.com
-
celebrityinfoarena.com
-
viaronsport.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\copia_rapida.pdf.exe"C:\Users\Admin\AppData\Local\Temp\copia_rapida.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\copia_rapida.pdf.exe"C:\Users\Admin\AppData\Local\Temp\copia_rapida.pdf.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1616-54-0x0000000000F20000-0x0000000001012000-memory.dmp
memory/1616-55-0x00000000008B0000-0x00000000008C2000-memory.dmp
memory/1616-56-0x0000000008080000-0x0000000008178000-memory.dmp
memory/1616-57-0x0000000000D40000-0x0000000000D70000-memory.dmp
memory/1956-58-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1956-59-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1956-61-0x0000000000400000-0x0000000000429000-memory.dmp