Analysis
- max time kernel
43s - max time network
46s - platform
windows7_x64 - resource
win7-20220331-en - submitted
05/04/2022, 18:12
General
- Target dhl Shipment of Original Documents.exe
- Size 553KB
- Sample220405-ws6bbsbbd6
- SHA256 48642cfdf59906d5b22ec805f79b953e37a44d4dad2bef8b55e5155dfe92ad55
Malware Config
Extracted
-
xloader
-
2.5
-
n8bs
-
monese-bank.com
-
silkypumps.xyz
-
tashabouvier.com
-
eduardoleonsilva.com
-
pinnaclecorporaterentals.com
-
megafluids.com
-
worldwidecarfans.com
-
benjamlnesq.com
-
unitedraxiapp.com
-
thetanheroes.com
-
jypmore.quest
-
indianasheriffs.biz
-
saintinstead.com
-
alldansmx.com
-
trulyproofreading.com
-
indotogel369.com
-
mermadekusse.store
-
radosenterprisellc.com
-
gseequalservices.com
-
techride.xyz
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dhl Shipment of Original Documents.exe"C:\Users\Admin\AppData\Local\Temp\dhl Shipment of Original Documents.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dhl Shipment of Original Documents.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1444-54-0x0000000000EF0000-0x0000000000F80000-memory.dmp
memory/1444-55-0x00000000005C0000-0x00000000005CA000-memory.dmp
memory/1444-56-0x0000000007F30000-0x0000000007FAE000-memory.dmp
memory/1444-57-0x0000000000A00000-0x0000000000A30000-memory.dmp
memory/2016-58-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2016-59-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2016-61-0x0000000000400000-0x0000000000429000-memory.dmp