Analysis
- max time kernel
4294184s - max time network
123s - platform
windows7_x64 - resource
win7-20220311-en - submitted
31/03/2022, 14:06
General
- Target kopje e pageses bankare.03302022.exe
- Size 965KB
- Sample220331-redxpsdad7
- SHA256 56958cbd9007cf88fbf7bbe0ab8cdd745af7c3cb43f495cf12ef37cace388bcb
Score
10/10
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
euv4
Decoy
-
anniebapartments.com
-
hagenbicycles.com
-
herbalist101.com
-
southerncorrosion.net
-
kuechenpruefer.com
-
tajniezdrzi.quest
-
segurofunerarioar.com
-
boardsandbeamsdecor.com
-
alifdanismanlik.com
-
pkem.top
-
mddc.clinic
-
handejqr.com
-
crux-at.com
-
awp.email
-
hugsforbubbs.com
-
cielotherepy.com
-
turkcuyuz.com
-
teamidc.com
-
lankasirinspa.com
-
68135.online
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\kopje e pageses bankare.03302022.exe"C:\Users\Admin\AppData\Local\Temp\kopje e pageses bankare.03302022.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1563⤵
- Program crash
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1800-54-0x0000000075081000-0x0000000075083000-memory.dmp
memory/2032-56-0x0000000010410000-0x0000000010439000-memory.dmp
memory/2032-58-0x00000000000C0000-0x00000000000C1000-memory.dmp