Analysis
- max time kernel
152s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
21/04/2022, 08:33
General
- Target Quotation #3200025006.exe
- Size 632KB
- Sample220421-kfw2caadgj
- SHA256 fba3315dff9db2942ea64b91b77cf06855e83b1eed9199cfed679b08f65f9f69
Malware Config
Extracted
-
xloader
-
2.5
-
mwfc
-
a-great-intl-voip-phones.zone
-
police-trust-security.com
-
415391.com
-
coi-sl.com
-
liming-steel.com
-
criticalracetheoryexplained.com
-
pintoent.com
-
columbusrx.com
-
clarktribe.net
-
texasforblanchard.com
-
musical.voyage
-
priyamblogs.com
-
employbridge.works
-
americanchessmaster.com
-
australiaaddictioncenters.com
-
drkell-yann.xyz
-
barryisdaner.com
-
frankkystein.art
-
aromatoto7.com
-
alsuwal.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation #3200025006.exe"C:\Users\Admin\AppData\Local\Temp\Quotation #3200025006.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation #3200025006.exe"C:\Users\Admin\AppData\Local\Temp\Quotation #3200025006.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Quotation #3200025006.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/888-141-0x0000000008500000-0x0000000008610000-memory.dmp
memory/888-148-0x0000000008610000-0x00000000086CC000-memory.dmp
memory/1888-131-0x0000000007D00000-0x00000000082A4000-memory.dmp
memory/1888-132-0x00000000077F0000-0x0000000007882000-memory.dmp
memory/1888-133-0x00000000077E0000-0x00000000077EA000-memory.dmp
memory/1888-134-0x0000000009E20000-0x0000000009EBC000-memory.dmp
memory/1888-135-0x000000000B250000-0x000000000B2B6000-memory.dmp
memory/1888-130-0x00000000009C0000-0x0000000000A66000-memory.dmp
memory/4412-144-0x0000000000360000-0x0000000000387000-memory.dmp
memory/4412-145-0x0000000000220000-0x0000000000249000-memory.dmp
memory/4412-146-0x00000000026D0000-0x0000000002A1A000-memory.dmp
memory/4412-147-0x00000000023F0000-0x0000000002480000-memory.dmp
memory/4632-140-0x0000000001D90000-0x0000000001DA1000-memory.dmp
memory/4632-139-0x0000000001910000-0x0000000001C5A000-memory.dmp
memory/4632-137-0x0000000000400000-0x0000000000429000-memory.dmp