Analysis
- max time kernel
4294183s - max time network
132s - platform
windows7_x64 - resource
win7-20220311-en - submitted
28/03/2022, 13:59
General
- Target TransferCompleteUSD30000.exe
- Size 842KB
- Sample220328-radfdaaff4
- SHA256 63fef1355c2426329defba3c5fc037b68085c45196ab8bd7ff2991b5dcfc80c0
Score
10/10
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
tee5
Decoy
-
brentkharper.store
-
myfranciscanshoe.com
-
evlilikilani.com
-
cortadoresdejamon.biz
-
ckypas.com
-
rsyncpalace.com
-
sinceretour.com
-
rgholdingsgroup.com
-
anupamagopalakrishnan.com
-
torshowroom.com
-
miraliva.com
-
naove.net
-
alendigital.xyz
-
buckeyeedc.com
-
persianclassic.com
-
temppou.com
-
infiniteinvesting.net
-
blodgettlabranch.com
-
arches2.com
-
tesoricollection.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TransferCompleteUSD30000.exe"C:\Users\Admin\AppData\Local\Temp\TransferCompleteUSD30000.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 1563⤵
- Program crash
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/876-54-0x0000000075AD1000-0x0000000075AD3000-memory.dmp
memory/1000-56-0x0000000010410000-0x0000000010439000-memory.dmp
memory/1000-58-0x0000000000080000-0x0000000000081000-memory.dmp