Analysis
- max time kernel
163s - max time network
169s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
25/03/2022, 10:34
General
- Target newest payment.exe
- Size 1.0MB
- Sample220325-ml6h3sbdar
- SHA256 805a169b8f08ee6d903d5ea86178a1e50e65ae3c51a91085227b0e77c04efbea
Malware Config
Extracted
-
xloader
-
2.5
-
u55j
-
empecher-beschermen.com
-
heinousas.com
-
new-passion.com
-
mbah-jamal-store.online
-
simple-tools.store
-
liveinblog.com
-
anvilair.com
-
greatrewardsforheroes.com
-
michaelolsonphotography.com
-
taxlesstudio.com
-
bennedynceoa.xyz
-
thriveluxury.com
-
jhaww.com
-
bt060.com
-
nfttravel.xyz
-
kridhatrinity.com
-
zyjust.com
-
dew-directory.xyz
-
powderspringsmechanic.com
-
gitudoang.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\newest payment.exe"C:\Users\Admin\AppData\Local\Temp\newest payment.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/896-139-0x00000000075F0000-0x000000000773F000-memory.dmp
memory/896-145-0x0000000008DA0000-0x0000000008F18000-memory.dmp
memory/2188-141-0x00000000009B0000-0x0000000000A07000-memory.dmp
memory/2188-142-0x0000000000110000-0x0000000000139000-memory.dmp
memory/2188-143-0x0000000002560000-0x00000000028AA000-memory.dmp
memory/2188-144-0x0000000002200000-0x0000000002290000-memory.dmp
memory/2428-135-0x0000000010410000-0x0000000010439000-memory.dmp
memory/2428-136-0x0000000002FD0000-0x000000000331A000-memory.dmp
memory/2428-138-0x0000000002EC0000-0x0000000002ED1000-memory.dmp