Analysis
- max time kernel
153s - max time network
157s - platform
windows7_x64 - resource
win7-20220331-en - submitted
14/04/2022, 12:44
General
- Target SecuriteInfo.com.Scr.Malcodegdn30.21924.exe
- Size 850KB
- Sample220414-pyf53acbf7
- SHA256 61ee0cca6d45766ecfedcfafba7f2e57d8fc2f4ee9b42bce3e7ffe5848c071f9
Malware Config
Extracted
-
xloader
-
2.5
-
ee3s
-
irvid.info
-
mivolts.com
-
wucaishisc.com
-
armadajo.com
-
mamamachi.com
-
uzakichan.online
-
adampulpit.com
-
payments-gate-325r.xyz
-
tangoespasion.com
-
bjyanqiao.com
-
nutrioclinic.com
-
kffreshfruit.com
-
luokeseals.com
-
c19.one
-
bssystemonline.com
-
bit-eth.com
-
thepopularboots.com
-
erikakorma.com
-
736141.com
-
graceinchina.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 4 IoCs
- Blocklisted process makes network request 4 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Scr.Malcodegdn30.21924.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Scr.Malcodegdn30.21924.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1192-67-0x0000000004C20000-0x0000000004D53000-memory.dmp
memory/1192-77-0x0000000004FC0000-0x00000000050D7000-memory.dmp
memory/1192-70-0x00000000041D0000-0x00000000042A4000-memory.dmp
memory/1536-55-0x0000000000560000-0x000000000056E000-memory.dmp
memory/1536-56-0x0000000004560000-0x000000000460C000-memory.dmp
memory/1536-57-0x0000000005E60000-0x0000000005ECC000-memory.dmp
memory/1536-54-0x0000000000930000-0x0000000000A0A000-memory.dmp
memory/1924-76-0x00000000024E0000-0x0000000002570000-memory.dmp
memory/1924-74-0x00000000000D0000-0x00000000000F9000-memory.dmp
memory/1924-73-0x0000000000520000-0x0000000000534000-memory.dmp
memory/1924-72-0x0000000075A51000-0x0000000075A53000-memory.dmp
memory/1924-75-0x00000000021D0000-0x00000000024D3000-memory.dmp
memory/1980-59-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1980-69-0x00000000001D0000-0x00000000001E1000-memory.dmp
memory/1980-66-0x0000000000140000-0x0000000000151000-memory.dmp
memory/1980-65-0x0000000000EA0000-0x00000000011A3000-memory.dmp
memory/1980-64-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1980-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1980-58-0x0000000000400000-0x0000000000429000-memory.dmp