Analysis
- max time kernel
153s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
28/03/2022, 04:24
General
- Target SWIFT MT103 28032022.exe
- Size 1.1MB
- Sample220328-e1c63scebj
- SHA256 d6e96fd4a8960b01d5a03e2d0fc3c0e502e7e5d0b4648eb53aa6e7eae42d2c7a
Malware Config
Extracted
-
xloader
-
2.5
-
n8bs
-
monese-bank.com
-
silkypumps.xyz
-
tashabouvier.com
-
eduardoleonsilva.com
-
pinnaclecorporaterentals.com
-
megafluids.com
-
worldwidecarfans.com
-
benjamlnesq.com
-
unitedraxiapp.com
-
thetanheroes.com
-
jypmore.quest
-
indianasheriffs.biz
-
saintinstead.com
-
alldansmx.com
-
trulyproofreading.com
-
indotogel369.com
-
mermadekusse.store
-
radosenterprisellc.com
-
gseequalservices.com
-
techride.xyz
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SWIFT MT103 28032022.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT MT103 28032022.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SWIFT MT103 28032022.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT MT103 28032022.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SWIFT MT103 28032022.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT MT103 28032022.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SWIFT MT103 28032022.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2964-146-0x0000000008670000-0x00000000087FB000-memory.dmp
memory/2964-153-0x0000000008F50000-0x000000000908F000-memory.dmp
memory/3860-135-0x0000000005FC0000-0x0000000006564000-memory.dmp
memory/3860-136-0x0000000005A10000-0x0000000005AA2000-memory.dmp
memory/3860-137-0x0000000003670000-0x000000000367A000-memory.dmp
memory/3860-138-0x0000000007D50000-0x0000000007DEC000-memory.dmp
memory/3860-134-0x0000000000F00000-0x000000000101C000-memory.dmp
memory/4552-143-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4552-145-0x0000000001090000-0x00000000010A1000-memory.dmp
memory/4552-144-0x0000000001520000-0x000000000186A000-memory.dmp
memory/4552-141-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4588-149-0x00000000009C0000-0x00000000009E9000-memory.dmp
memory/4588-148-0x0000000000AC0000-0x0000000000ACC000-memory.dmp
memory/4588-151-0x0000000002D20000-0x000000000306A000-memory.dmp
memory/4588-152-0x0000000002A50000-0x0000000002AE0000-memory.dmp