Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
11/04/2022, 08:44
General
- Target 54cbaf431313a0936f684aa2a187934f.exe
- Size 899KB
- Sample220411-km58laffd5
- SHA256 239419437726bda1c5401f36629aa95050346433232192947ca54890ebb8a39f
Malware Config
Extracted
-
xloader
-
2.5
-
xtef
-
themarimethod.com
-
scandicinvestmentholding.com
-
glamcontactlens.com
-
theyoupowerproject.com
-
positif-marketing.com
-
criticalthinking.store
-
annurgroup.com
-
smart-book.space
-
veriloot.com
-
javfor.info
-
alliedarlington.com
-
thelooapp.com
-
rugisdh.com
-
tjhuanbin.com
-
lly03toyof6.xyz
-
jamet88.com
-
portusfunds.com
-
618651.com
-
theparentharbour.com
-
gacor-pragmatic.xyz
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\54cbaf431313a0936f684aa2a187934f.exe"C:\Users\Admin\AppData\Local\Temp\54cbaf431313a0936f684aa2a187934f.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1216-134-0x0000000010410000-0x0000000010439000-memory.dmp
memory/1216-136-0x00000000026A0000-0x00000000029EA000-memory.dmp
memory/1216-137-0x00000000022F0000-0x0000000002301000-memory.dmp
memory/2628-138-0x00000000091B0000-0x0000000009329000-memory.dmp
memory/2628-144-0x0000000003630000-0x00000000036F7000-memory.dmp
memory/4728-141-0x0000000000B60000-0x0000000000B89000-memory.dmp
memory/4728-140-0x00000000001D0000-0x00000000001DE000-memory.dmp
memory/4728-142-0x0000000001800000-0x0000000001B4A000-memory.dmp
memory/4728-143-0x0000000001690000-0x0000000001720000-memory.dmp