Analysis
- max time kernel
146s - max time network
147s - platform
windows7_x64 - resource
win7-20220414-en - submitted
26/04/2022, 04:34
General
- Target Invoice.exe
- Size 613KB
- Sample220426-e662cabaa2
- SHA256 c0e6b0b4e80d36f0872fe01ed20cc5a6d17083f6d11ff93cc5ccc841dd43aa33
Malware Config
Extracted
-
xloader
-
2.5
-
gfge
-
loopcoalition.com
-
hd126.com
-
elioguion.net
-
defitrader.academy
-
exactemi.com
-
angeloacierno.com
-
range4tis.com
-
ilovekuduro.us
-
mydealsstation.com
-
jerichoprinting.com
-
birdcafe605.com
-
freemansrepublic.com
-
driedplasma.com
-
valuableconnect.com
-
anthonyvid.xyz
-
theydo.support
-
devnetsecops.com
-
cryptork.tech
-
ufheur678.store
-
lavenderspa586.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 4 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Invoice.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1092-54-0x00000000013B0000-0x000000000144E000-memory.dmp
memory/1092-55-0x0000000000360000-0x0000000000372000-memory.dmp
memory/1092-56-0x0000000004E80000-0x0000000004EF2000-memory.dmp
memory/1092-57-0x0000000000D40000-0x0000000000D70000-memory.dmp
memory/1116-74-0x0000000001DB0000-0x0000000001E40000-memory.dmp
memory/1116-69-0x00000000765C1000-0x00000000765C3000-memory.dmp
memory/1116-73-0x0000000001F40000-0x0000000002243000-memory.dmp
memory/1116-72-0x00000000000C0000-0x00000000000E9000-memory.dmp
memory/1116-71-0x0000000000800000-0x0000000000818000-memory.dmp
memory/1272-75-0x0000000004510000-0x00000000045C8000-memory.dmp
memory/1272-67-0x00000000070B0000-0x0000000007207000-memory.dmp
memory/1736-59-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1736-66-0x0000000000140000-0x0000000000151000-memory.dmp
memory/1736-65-0x0000000000970000-0x0000000000C73000-memory.dmp
memory/1736-64-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1736-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1736-58-0x0000000000400000-0x0000000000429000-memory.dmp