Analysis
- max time kernel
136s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
30/03/2022, 14:47
General
- Target SecuriteInfo.com.Scr.Malcodegdn30.31730.exe
- Size 476KB
- Sample220330-r5vm5sdaa4
- SHA256 d6ee29c576a6f06612430d000f2f72fd64df7763a982acf42e72f4bcd4665c3a
Malware Config
Extracted
-
xloader
-
2.5
-
p89m
-
wrapapplausechutney.xyz
-
covidmobiletestingmd.com
-
convey.gifts
-
b148tlrfee9evtvorgm5947.com
-
zmlhtjfls.com
-
mctrumpthyism.com
-
lilaixi.store
-
interstatehardwarenj.com
-
horakokode.com
-
42wilsonavenue.com
-
muskanphysio.com
-
absoluteuniquecrafts.store
-
donategame.online
-
greenlinkengineering.net
-
pinchanzosloyalty.com
-
companyintel.network
-
resumewriterguru.com
-
oakalleyatcimarron.com
-
sriyawealthplan.com
-
mpcollection.online
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Scr.Malcodegdn30.31730.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Scr.Malcodegdn30.31730.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Scr.Malcodegdn30.31730.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Scr.Malcodegdn30.31730.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1204-141-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1204-142-0x0000000001550000-0x000000000189A000-memory.dmp
memory/4816-134-0x0000000000450000-0x00000000004CE000-memory.dmp
memory/4816-135-0x00000000054A0000-0x0000000005A44000-memory.dmp
memory/4816-136-0x0000000004EF0000-0x0000000004F82000-memory.dmp
memory/4816-137-0x0000000004E80000-0x0000000004E8A000-memory.dmp
memory/4816-138-0x0000000007300000-0x000000000739C000-memory.dmp
memory/4816-139-0x0000000007640000-0x00000000076A6000-memory.dmp