Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
04/04/2022, 09:28
General
- Target xwpwCCbOtiF8wAO.exe
- Size 835KB
- Sample220404-lfbabaghfr
- SHA256 bc5116cdc710b153d2c32a9ecb5bccd7f3ed3c4cee398b9eba9f482dc5c77cd1
Malware Config
Extracted
-
xloader
-
2.5
-
iqof
-
downssandblasting.online
-
shopcongan.info
-
financeservicesolutions.com
-
ehiconao.com
-
15beverlydrive.com
-
happynize.net
-
findzx.net
-
kelly-peterson.xyz
-
datalign-exchange.com
-
kinemasterpro.pro
-
amage.agency
-
roleplayhr.com
-
movingikea.com
-
steinerikegeberg.com
-
nikolashadow.com
-
baumbestattung.net
-
mms12.xyz
-
cryptocurrencymarket.space
-
colt.business
-
neutralblocker.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xwpwCCbOtiF8wAO.exe"C:\Users\Admin\AppData\Local\Temp\xwpwCCbOtiF8wAO.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xwpwCCbOtiF8wAO.exe"C:\Users\Admin\AppData\Local\Temp\xwpwCCbOtiF8wAO.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\xwpwCCbOtiF8wAO.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1068-143-0x0000000008010000-0x000000000817B000-memory.dmp
memory/1068-136-0x0000000007E90000-0x000000000800C000-memory.dmp
memory/3180-135-0x0000000000ED0000-0x0000000000EE1000-memory.dmp
memory/3180-133-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3180-134-0x0000000000EF0000-0x000000000123A000-memory.dmp
memory/3180-131-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4648-128-0x0000000007810000-0x00000000078AC000-memory.dmp
memory/4648-129-0x0000000007B70000-0x0000000007BD6000-memory.dmp
memory/4648-124-0x0000000000630000-0x0000000000706000-memory.dmp
memory/4648-127-0x00000000050A0000-0x00000000050AA000-memory.dmp
memory/4648-126-0x0000000005110000-0x00000000051A2000-memory.dmp
memory/4648-125-0x0000000005620000-0x0000000005BC4000-memory.dmp
memory/4940-139-0x0000000000A80000-0x0000000000AA9000-memory.dmp
memory/4940-138-0x0000000000560000-0x000000000056B000-memory.dmp
memory/4940-141-0x0000000001240000-0x000000000158A000-memory.dmp
memory/4940-142-0x00000000010B0000-0x0000000001140000-memory.dmp