Analysis
- max time kernel
42s - max time network
45s - platform
windows7_x64 - resource
win7-20220331-en - submitted
04/04/2022, 09:37
General
- Target Payment Copy.exe
- Size 749KB
- Sample220404-llf3radcd8
- SHA256 3a3e12eabec6d3f196912bfeca3527aa7f965721489217d25b663af4a88cd25f
Malware Config
Extracted
-
xloader
-
2.5
-
u6fn
-
therealspectrum.com
-
charlottewright.online
-
desertmermaidcreations.com
-
shermanrockfest.com
-
msportmotorcars.com
-
guifenglegal.xyz
-
nationalbackgammontour.com
-
unitedstatesofworship.com
-
printgo119.com
-
milkmantheory.com
-
zj-fabric.com
-
patrickwritescode.com
-
authentically-donamaria.com
-
muzica.pro
-
littelbuilding.com
-
intaom.com
-
sirotech.tech
-
ecobi.net
-
googlemyvideo.com
-
suitadd.xyz
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe"C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment Copy.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1644-54-0x0000000000290000-0x0000000000352000-memory.dmp
memory/1644-55-0x0000000000370000-0x000000000037A000-memory.dmp
memory/1644-56-0x0000000004630000-0x00000000046AE000-memory.dmp
memory/1644-57-0x0000000004140000-0x0000000004170000-memory.dmp
memory/2036-58-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2036-59-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2036-61-0x0000000000400000-0x0000000000429000-memory.dmp