Analysis
- max time kernel
151s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
08/04/2022, 06:40
General
- Target TT_copy.exe
- Size 514KB
- Sample220408-he7qcaeeeq
- SHA256 fa41d632cd7c8ed80982c6cfa90e964e086ec9c0c78344e76f8f62d9343941d9
Malware Config
Extracted
-
xloader
-
2.5
-
ioxf
-
196658.com
-
dhwbx.com
-
druid-club.store
-
anandiapers.top
-
47279s.com
-
veoks.com
-
oreillyandrew.com
-
hips5r.com
-
grandvillecarshow.com
-
pding39.com
-
e-zinkpromos.com
-
ktimeny.com
-
ccleanerpro.digital
-
financetrademarkets.com
-
qinsida.net
-
wood-paulownia.com
-
cafezinho-dubai.com
-
vallvoline.com
-
urbanfashionstore.com
-
plymouthfoodcourt.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\TT_copy.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/636-144-0x0000000001450000-0x0000000001461000-memory.dmp
memory/636-143-0x00000000014C0000-0x000000000180A000-memory.dmp
memory/636-142-0x0000000000400000-0x0000000000429000-memory.dmp
memory/636-140-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1100-147-0x0000000000E20000-0x0000000000E2B000-memory.dmp
memory/1100-148-0x0000000000F20000-0x0000000000F49000-memory.dmp
memory/1100-150-0x0000000001890000-0x0000000001BDA000-memory.dmp
memory/1100-151-0x00000000017A0000-0x0000000001830000-memory.dmp
memory/2736-145-0x0000000007F70000-0x00000000080EC000-memory.dmp
memory/2736-152-0x00000000080F0000-0x0000000008184000-memory.dmp
memory/4284-138-0x0000000004FF0000-0x0000000004FFA000-memory.dmp
memory/4284-137-0x0000000005090000-0x000000000512C000-memory.dmp
memory/4284-136-0x0000000004F50000-0x0000000004FE2000-memory.dmp
memory/4284-135-0x0000000005500000-0x0000000005AA4000-memory.dmp
memory/4284-134-0x0000000000520000-0x00000000005A6000-memory.dmp