Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
06/04/2022, 15:48
General
- Target f73ab7df3c255fc1634f623d0ab2c09b.exe
- Size 496KB
- Sample220406-s8rlbsbdgj
- SHA256 6aecf2a84c05d52c3789b9b22ef5c046eed5dee698e2d94d61cda7219d32bb00
Malware Config
Extracted
-
xloader
-
2.5
-
mj6u
-
litrpgwiki.net
-
bichill.net
-
rangersprotocol-sale.com
-
lj6222.com
-
instrurent.online
-
pet-field.com
-
chosen-novels.com
-
soul-leaf.com
-
supraforward.com
-
hrdsecuritysolutions.com
-
ccfuydao.com
-
transactionflow360.com
-
homesteaders.xyz
-
sapphirearray.com
-
swissgroup.investments
-
capshopnateasy.rest
-
lanturalperu.com
-
ooasne.com
-
yoo-tech.com
-
uyoplaza.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f73ab7df3c255fc1634f623d0ab2c09b.exe"C:\Users\Admin\AppData\Local\Temp\f73ab7df3c255fc1634f623d0ab2c09b.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1316-131-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1316-133-0x00000000013C0000-0x000000000170A000-memory.dmp
memory/1316-134-0x00000000018C0000-0x00000000018D1000-memory.dmp
memory/1496-141-0x0000000002120000-0x00000000021B0000-memory.dmp
memory/1496-139-0x0000000000180000-0x00000000001A9000-memory.dmp
memory/1496-140-0x0000000002400000-0x000000000274A000-memory.dmp
memory/1496-138-0x0000000000C60000-0x0000000000C76000-memory.dmp
memory/2776-142-0x00000000030D0000-0x00000000031DA000-memory.dmp
memory/2776-135-0x00000000088C0000-0x0000000008A41000-memory.dmp
memory/4868-124-0x0000000000D50000-0x0000000000DD2000-memory.dmp
memory/4868-129-0x0000000009390000-0x00000000093F6000-memory.dmp
memory/4868-128-0x0000000007910000-0x00000000079AC000-memory.dmp
memory/4868-127-0x0000000005780000-0x000000000578A000-memory.dmp
memory/4868-126-0x00000000057B0000-0x0000000005842000-memory.dmp
memory/4868-125-0x0000000005EC0000-0x0000000006464000-memory.dmp