Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
28/03/2022, 13:59
General
- Target TransferCompleteUSD30000.exe
- Size 842KB
- Sample220328-radfdaaff4
- SHA256 63fef1355c2426329defba3c5fc037b68085c45196ab8bd7ff2991b5dcfc80c0
Malware Config
Extracted
-
xloader
-
2.5
-
tee5
-
brentkharper.store
-
myfranciscanshoe.com
-
evlilikilani.com
-
cortadoresdejamon.biz
-
ckypas.com
-
rsyncpalace.com
-
sinceretour.com
-
rgholdingsgroup.com
-
anupamagopalakrishnan.com
-
torshowroom.com
-
miraliva.com
-
naove.net
-
alendigital.xyz
-
buckeyeedc.com
-
persianclassic.com
-
temppou.com
-
infiniteinvesting.net
-
blodgettlabranch.com
-
arches2.com
-
tesoricollection.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TransferCompleteUSD30000.exe"C:\Users\Admin\AppData\Local\Temp\TransferCompleteUSD30000.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3032-136-0x0000000008440000-0x00000000085E3000-memory.dmp
memory/3032-142-0x00000000080B0000-0x0000000008173000-memory.dmp
memory/3720-132-0x0000000010410000-0x0000000010439000-memory.dmp
memory/3720-134-0x0000000003170000-0x00000000034BA000-memory.dmp
memory/3720-135-0x00000000030F0000-0x0000000003101000-memory.dmp
memory/4924-138-0x0000000000EB0000-0x0000000000EB6000-memory.dmp
memory/4924-139-0x0000000000CE0000-0x0000000000D09000-memory.dmp
memory/4924-140-0x0000000002CD0000-0x000000000301A000-memory.dmp
memory/4924-141-0x00000000029F0000-0x0000000002A80000-memory.dmp