Analysis
- max time kernel
153s - max time network
166s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
01/04/2022, 13:59
General
- Target NEW QUOTATION REQUEST.exe
- Size 533KB
- Sample220401-radfdacdd4
- SHA256 ac35cec2587a18dcd2be9da436cf76376c8b52de1b3637f1eee9490b227ba08a
Malware Config
Extracted
-
xloader
-
2.5
-
pg3o
-
thelostrose.com
-
liebemadchen4u.art
-
scuzzfest.com
-
labalhadi.com
-
ecran-thermique.com
-
explorepanel.com
-
smdledneonflex.com
-
jpstandardcompany.net
-
gunspatrol.com
-
dugerits.com
-
asquaredlegalgroup.com
-
sasha-media.com
-
praconsultingandinspection.com
-
awaisqarni.com
-
paysology.com
-
terradr.one
-
lorebeasts.com
-
mapiadventuretour.com
-
dietatrintadias.com
-
powerether.online
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW QUOTATION REQUEST.exe"C:\Users\Admin\AppData\Local\Temp\NEW QUOTATION REQUEST.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW QUOTATION REQUEST.exe"C:\Users\Admin\AppData\Local\Temp\NEW QUOTATION REQUEST.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\NEW QUOTATION REQUEST.exe"C:\Users\Admin\AppData\Local\Temp\NEW QUOTATION REQUEST.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW QUOTATION REQUEST.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/736-141-0x00000000029A0000-0x0000000002A30000-memory.dmp
memory/736-140-0x0000000002AE0000-0x0000000002E2A000-memory.dmp
memory/736-138-0x0000000000570000-0x000000000057C000-memory.dmp
memory/736-139-0x0000000000C10000-0x0000000000C39000-memory.dmp
memory/2224-127-0x0000000005750000-0x00000000057EC000-memory.dmp
memory/2224-124-0x0000000000770000-0x00000000007FC000-memory.dmp
memory/2224-128-0x00000000061B0000-0x0000000006216000-memory.dmp
memory/2224-126-0x0000000005350000-0x00000000053E2000-memory.dmp
memory/2224-125-0x0000000005A10000-0x0000000005FB4000-memory.dmp
memory/2692-142-0x00000000087D0000-0x00000000088E1000-memory.dmp
memory/2692-135-0x0000000008670000-0x00000000087CB000-memory.dmp
memory/5056-133-0x00000000019A0000-0x0000000001CEA000-memory.dmp
memory/5056-134-0x00000000014F0000-0x0000000001501000-memory.dmp
memory/5056-131-0x0000000000400000-0x0000000000429000-memory.dmp