Analysis
- max time kernel
4294178s - max time network
122s - platform
windows7_x64 - resource
win7-20220311-en - submitted
28/03/2022, 04:24
General
- Target SWIFT MT103 28032022.exe
- Size 1.1MB
- Sample220328-e1c63scebj
- SHA256 d6e96fd4a8960b01d5a03e2d0fc3c0e502e7e5d0b4648eb53aa6e7eae42d2c7a
Malware Config
Extracted
-
xloader
-
2.5
-
n8bs
-
monese-bank.com
-
silkypumps.xyz
-
tashabouvier.com
-
eduardoleonsilva.com
-
pinnaclecorporaterentals.com
-
megafluids.com
-
worldwidecarfans.com
-
benjamlnesq.com
-
unitedraxiapp.com
-
thetanheroes.com
-
jypmore.quest
-
indianasheriffs.biz
-
saintinstead.com
-
alldansmx.com
-
trulyproofreading.com
-
indotogel369.com
-
mermadekusse.store
-
radosenterprisellc.com
-
gseequalservices.com
-
techride.xyz
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SWIFT MT103 28032022.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT MT103 28032022.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SWIFT MT103 28032022.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT MT103 28032022.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1584-54-0x0000000000860000-0x000000000097C000-memory.dmp
memory/1584-55-0x0000000000250000-0x000000000025A000-memory.dmp
memory/1584-56-0x0000000007F40000-0x0000000008038000-memory.dmp
memory/1584-57-0x0000000000A70000-0x0000000000AA0000-memory.dmp
memory/1892-58-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1892-59-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1892-61-0x0000000000400000-0x0000000000429000-memory.dmp