Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
14/04/2022, 19:57
General
- Target Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe
- Size 966KB
- Sample220414-yn9jasdfgp
- SHA256 9ed12486b8f2201f6e6783b44fb9fda3ca0866f746abe3269b8b9bb1edab45b2
Malware Config
Extracted
-
xloader
-
2.5
-
g6k0
-
tour-peru-machupicchu.com
-
hautebazaar.net
-
southking.tech
-
b148tlrnd09ustnnaku2721.com
-
finlandnine.xyz
-
nevalostrecords.com
-
yberwomanshowcase.com
-
fourfatcats.com
-
pa66sujiao.com
-
bodychile.com
-
vireoenvironmentalllc.com
-
williamhag.online
-
tsctribe.com
-
tenutoai.com
-
10thring.com
-
picturebookoriginals.com
-
discord-gif.xyz
-
benefitcarolina.com
-
stellarsweats.com
-
cr7tips.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe"C:\Users\Admin\AppData\Local\Temp\Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe"C:\Users\Admin\AppData\Local\Temp\Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/820-124-0x00000000002B0000-0x00000000003A6000-memory.dmp
memory/820-125-0x00000000053C0000-0x0000000005964000-memory.dmp
memory/820-126-0x0000000004D30000-0x0000000004DC2000-memory.dmp
memory/820-127-0x0000000004F30000-0x0000000004FCC000-memory.dmp
memory/820-128-0x0000000004DF0000-0x0000000004DFA000-memory.dmp
memory/820-129-0x0000000008720000-0x0000000008786000-memory.dmp
memory/2132-138-0x0000000000D00000-0x0000000000DDC000-memory.dmp
memory/2132-139-0x0000000000510000-0x0000000000539000-memory.dmp
memory/2132-141-0x00000000016C0000-0x0000000001A0A000-memory.dmp
memory/2132-142-0x00000000013F0000-0x0000000001480000-memory.dmp
memory/3040-136-0x00000000085C0000-0x0000000008746000-memory.dmp
memory/3040-143-0x00000000087F0000-0x000000000897B000-memory.dmp
memory/3576-131-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3576-133-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3576-134-0x0000000000ED0000-0x0000000000EE1000-memory.dmp
memory/3576-135-0x0000000001370000-0x00000000016BA000-memory.dmp