Analysis
- max time kernel
39s - max time network
47s - platform
windows7_x64 - resource
win7-20220331-en - submitted
01/04/2022, 13:59
General
- Target NEW QUOTATION REQUEST.exe
- Size 533KB
- Sample220401-radfdacdd4
- SHA256 ac35cec2587a18dcd2be9da436cf76376c8b52de1b3637f1eee9490b227ba08a
Malware Config
Extracted
-
xloader
-
2.5
-
pg3o
-
thelostrose.com
-
liebemadchen4u.art
-
scuzzfest.com
-
labalhadi.com
-
ecran-thermique.com
-
explorepanel.com
-
smdledneonflex.com
-
jpstandardcompany.net
-
gunspatrol.com
-
dugerits.com
-
asquaredlegalgroup.com
-
sasha-media.com
-
praconsultingandinspection.com
-
awaisqarni.com
-
paysology.com
-
terradr.one
-
lorebeasts.com
-
mapiadventuretour.com
-
dietatrintadias.com
-
powerether.online
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW QUOTATION REQUEST.exe"C:\Users\Admin\AppData\Local\Temp\NEW QUOTATION REQUEST.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW QUOTATION REQUEST.exe"C:\Users\Admin\AppData\Local\Temp\NEW QUOTATION REQUEST.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1892-54-0x0000000001020000-0x00000000010AC000-memory.dmp
memory/1892-55-0x0000000075E41000-0x0000000075E43000-memory.dmp
memory/1892-56-0x0000000000230000-0x000000000023C000-memory.dmp
memory/1892-57-0x0000000004D70000-0x0000000004DE2000-memory.dmp
memory/1892-58-0x00000000007B0000-0x00000000007E0000-memory.dmp
memory/2028-59-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2028-60-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2028-62-0x0000000000400000-0x0000000000429000-memory.dmp