Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    15-04-2022 11:54

General

  • Target

    YRS1504720.exe

  • Size

    878KB

  • MD5

    73aaabd4d5155a4ed6a37c6c33a21602

  • SHA1

    ef08b0d3e5429b93c2496747c5163fc55044adbe

  • SHA256

    b0689ba526627ae1cefce61dde4198b704f4ce53f898e1222f6ce40b73bd391c

  • SHA512

    1732e3d6b606b99187f1f17d171f05ef99b808e111b752ccc9453c3d851ef187b7e7a61fb23905233f31c05f8146285deddcab5588502a5b6071af1a39938f14

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 4 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1376
    • C:\Users\Admin\AppData\Local\Temp\YRS1504720.exe
      "C:\Users\Admin\AppData\Local\Temp\YRS1504720.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1828
      • C:\Users\Admin\AppData\Local\Temp\YRS1504720.exe
        "C:\Users\Admin\AppData\Local\Temp\YRS1504720.exe"
        3⤵
          PID:1780
        • C:\Users\Admin\AppData\Local\Temp\YRS1504720.exe
          "C:\Users\Admin\AppData\Local\Temp\YRS1504720.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:672
      • C:\Windows\SysWOW64\wuapp.exe
        "C:\Windows\SysWOW64\wuapp.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1628
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\YRS1504720.exe"
          3⤵
          • Deletes itself
          PID:1724

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/672-66-0x0000000000DD0000-0x00000000010D3000-memory.dmp
      Filesize

      3.0MB

    • memory/672-62-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/672-67-0x0000000000290000-0x00000000002A1000-memory.dmp
      Filesize

      68KB

    • memory/672-70-0x00000000002D0000-0x00000000002E1000-memory.dmp
      Filesize

      68KB

    • memory/672-59-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/672-60-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/672-63-0x000000000041D4F0-mapping.dmp
    • memory/672-65-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1376-71-0x00000000065C0000-0x0000000006701000-memory.dmp
      Filesize

      1.3MB

    • memory/1376-68-0x00000000062F0000-0x0000000006423000-memory.dmp
      Filesize

      1.2MB

    • memory/1376-78-0x0000000003F40000-0x0000000003FF8000-memory.dmp
      Filesize

      736KB

    • memory/1628-73-0x0000000000A50000-0x0000000000A5B000-memory.dmp
      Filesize

      44KB

    • memory/1628-72-0x0000000000000000-mapping.dmp
    • memory/1628-74-0x0000000000130000-0x0000000000159000-memory.dmp
      Filesize

      164KB

    • memory/1628-75-0x0000000001E60000-0x0000000002163000-memory.dmp
      Filesize

      3.0MB

    • memory/1628-77-0x00000000009A0000-0x0000000000A30000-memory.dmp
      Filesize

      576KB

    • memory/1724-76-0x0000000000000000-mapping.dmp
    • memory/1828-56-0x00000000002F0000-0x00000000002FA000-memory.dmp
      Filesize

      40KB

    • memory/1828-58-0x0000000000AB0000-0x0000000000B24000-memory.dmp
      Filesize

      464KB

    • memory/1828-57-0x0000000004CC0000-0x0000000004D74000-memory.dmp
      Filesize

      720KB

    • memory/1828-55-0x0000000007060000-0x0000000007112000-memory.dmp
      Filesize

      712KB

    • memory/1828-54-0x0000000000CE0000-0x0000000000DC4000-memory.dmp
      Filesize

      912KB