Analysis
- max time kernel
4294180s - max time network
122s - platform
windows7_x64 - resource
win7-20220311-en - submitted
05/04/2022, 18:13
General
- Target Dhl _SHIPPING DOC - #0036284639289.exe
- Size 953KB
- Sample220405-wtql9seecr
- SHA256 fbe213bf476b15f3d10fbb16a504e65fda87479b7947a2c38f825eb083a08379
Malware Config
Extracted
-
xloader
-
2.5
-
inga
-
21sq.xyz
-
aleimanpaper.com
-
soulworkerrush.com
-
lianxiwan.xyz
-
gorastionse.store
-
nuhuo333.xyz
-
greenft.xyz
-
upisout.com
-
mgav23.xyz
-
2day-recv.info
-
emdestak.com
-
generatorgmer.xyz
-
inmyhindi.com
-
meenubhosale.com
-
feinquebrantabledoc.com
-
valgtrizoma.quest
-
impqtantaou.com
-
nomorewarnow.com
-
gmcrjizppcx.mobi
-
eludice.net
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dhl _SHIPPING DOC - #0036284639289.exe"C:\Users\Admin\AppData\Local\Temp\Dhl _SHIPPING DOC - #0036284639289.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Dhl _SHIPPING DOC - #0036284639289.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/972-54-0x0000000001380000-0x0000000001474000-memory.dmp
memory/972-55-0x0000000000320000-0x000000000032A000-memory.dmp
memory/972-56-0x0000000004F80000-0x0000000005002000-memory.dmp
memory/972-57-0x0000000000670000-0x00000000006A0000-memory.dmp
memory/1340-58-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1340-59-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1340-61-0x0000000000400000-0x0000000000429000-memory.dmp