Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
26/04/2022, 04:34
General
- Target Invoice.exe
- Size 613KB
- Sample220426-e662cabaa2
- SHA256 c0e6b0b4e80d36f0872fe01ed20cc5a6d17083f6d11ff93cc5ccc841dd43aa33
Malware Config
Extracted
-
xloader
-
2.5
-
gfge
-
loopcoalition.com
-
hd126.com
-
elioguion.net
-
defitrader.academy
-
exactemi.com
-
angeloacierno.com
-
range4tis.com
-
ilovekuduro.us
-
mydealsstation.com
-
jerichoprinting.com
-
birdcafe605.com
-
freemansrepublic.com
-
driedplasma.com
-
valuableconnect.com
-
anthonyvid.xyz
-
theydo.support
-
devnetsecops.com
-
cryptork.tech
-
ufheur678.store
-
lavenderspa586.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 47 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Invoice.exe"3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1288-147-0x0000000002D00000-0x0000000002D90000-memory.dmp
memory/1288-145-0x0000000002DC0000-0x000000000310A000-memory.dmp
memory/1288-144-0x0000000000D20000-0x0000000000D49000-memory.dmp
memory/1288-143-0x0000000001000000-0x0000000001027000-memory.dmp
memory/1320-139-0x00000000014A0000-0x00000000017EA000-memory.dmp
memory/1320-138-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1320-140-0x0000000001480000-0x0000000001491000-memory.dmp
memory/1320-136-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1868-130-0x00000000000B0000-0x000000000014E000-memory.dmp
memory/1868-134-0x0000000005D50000-0x0000000005DB6000-memory.dmp
memory/1868-133-0x0000000005020000-0x00000000050BC000-memory.dmp
memory/1868-132-0x0000000004CE0000-0x0000000004D72000-memory.dmp
memory/1868-131-0x0000000005290000-0x0000000005834000-memory.dmp
memory/3168-141-0x0000000002820000-0x00000000028CC000-memory.dmp
memory/3168-148-0x0000000007EF0000-0x0000000007FF6000-memory.dmp