Analysis
- max time kernel
162s - max time network
180s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
25/03/2022, 18:43
General
- Target BL8785.exe
- Size 1.0MB
- Sample220325-xcx6fsbce7
- SHA256 01e55c453fc19c5df2c53fa3e1ddf9bc8f8af5ed23d361f3bc30df2e913072a1
Malware Config
Extracted
-
xloader
-
2.5
-
tee5
-
brentkharper.store
-
myfranciscanshoe.com
-
evlilikilani.com
-
cortadoresdejamon.biz
-
ckypas.com
-
rsyncpalace.com
-
sinceretour.com
-
rgholdingsgroup.com
-
anupamagopalakrishnan.com
-
torshowroom.com
-
miraliva.com
-
naove.net
-
alendigital.xyz
-
buckeyeedc.com
-
persianclassic.com
-
temppou.com
-
infiniteinvesting.net
-
blodgettlabranch.com
-
arches2.com
-
tesoricollection.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BL8785.exe"C:\Users\Admin\AppData\Local\Temp\BL8785.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1168-132-0x0000000010410000-0x0000000010439000-memory.dmp
memory/1168-134-0x0000000002640000-0x000000000298A000-memory.dmp
memory/1168-135-0x0000000002580000-0x0000000002591000-memory.dmp
memory/2060-136-0x0000000008620000-0x00000000087A9000-memory.dmp
memory/2060-142-0x0000000002990000-0x0000000002A55000-memory.dmp
memory/4336-138-0x0000000000330000-0x000000000033C000-memory.dmp
memory/4336-139-0x0000000002450000-0x000000000279A000-memory.dmp
memory/4336-140-0x00000000003C0000-0x00000000003E9000-memory.dmp
memory/4336-141-0x0000000002330000-0x00000000023C0000-memory.dmp