Analysis
- max time kernel
44s - max time network
48s - platform
windows7_x64 - resource
win7-20220331-en - submitted
04/04/2022, 09:28
General
- Target xwpwCCbOtiF8wAO.exe
- Size 835KB
- Sample220404-lfbabaghfr
- SHA256 bc5116cdc710b153d2c32a9ecb5bccd7f3ed3c4cee398b9eba9f482dc5c77cd1
Malware Config
Extracted
-
xloader
-
2.5
-
iqof
-
downssandblasting.online
-
shopcongan.info
-
financeservicesolutions.com
-
ehiconao.com
-
15beverlydrive.com
-
happynize.net
-
findzx.net
-
kelly-peterson.xyz
-
datalign-exchange.com
-
kinemasterpro.pro
-
amage.agency
-
roleplayhr.com
-
movingikea.com
-
steinerikegeberg.com
-
nikolashadow.com
-
baumbestattung.net
-
mms12.xyz
-
cryptocurrencymarket.space
-
colt.business
-
neutralblocker.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\xwpwCCbOtiF8wAO.exe"C:\Users\Admin\AppData\Local\Temp\xwpwCCbOtiF8wAO.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xwpwCCbOtiF8wAO.exe"C:\Users\Admin\AppData\Local\Temp\xwpwCCbOtiF8wAO.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1540-58-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1540-59-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1540-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1740-54-0x0000000001380000-0x0000000001456000-memory.dmp
memory/1740-55-0x0000000000B40000-0x0000000000B4C000-memory.dmp
memory/1740-56-0x00000000059F0000-0x0000000005AA4000-memory.dmp
memory/1740-57-0x0000000001220000-0x0000000001292000-memory.dmp