Analysis
- max time kernel
43s - max time network
46s - platform
windows7_x64 - resource
win7-20220331-en - submitted
08/04/2022, 06:40
General
- Target TT_copy.exe
- Size 514KB
- Sample220408-he7qcaeeeq
- SHA256 fa41d632cd7c8ed80982c6cfa90e964e086ec9c0c78344e76f8f62d9343941d9
Malware Config
Extracted
-
xloader
-
2.5
-
ioxf
-
196658.com
-
dhwbx.com
-
druid-club.store
-
anandiapers.top
-
47279s.com
-
veoks.com
-
oreillyandrew.com
-
hips5r.com
-
grandvillecarshow.com
-
pding39.com
-
e-zinkpromos.com
-
ktimeny.com
-
ccleanerpro.digital
-
financetrademarkets.com
-
qinsida.net
-
wood-paulownia.com
-
cafezinho-dubai.com
-
vallvoline.com
-
urbanfashionstore.com
-
plymouthfoodcourt.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1572-58-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1572-59-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1572-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1788-54-0x0000000001380000-0x0000000001406000-memory.dmp
memory/1788-55-0x00000000003F0000-0x00000000003FA000-memory.dmp
memory/1788-56-0x00000000052C0000-0x0000000005342000-memory.dmp
memory/1788-57-0x0000000000520000-0x0000000000550000-memory.dmp