Analysis
- max time kernel
61s - max time network
46s - platform
windows7_x64 - resource
win7-20220414-en - submitted
04/05/2022, 04:31
General
- Target SecuriteInfo.com.Trojan.MSIL.AgentTesla.ERR.MTB.26943.exe
- Size 687KB
- Sample220504-e5c2wadaf6
- SHA256 06bdc739d26559129afbc157dff8ef0f616dbe885a6cd8a2f43b62efaf848bb9
Malware Config
Extracted
-
xloader
-
2.5
-
mexq
-
universopromocionales.info
-
24-7-solutions.com
-
procofun.com
-
shanghaihuamian.com
-
improvabeauty.com
-
khaulahmuadzah.com
-
turbofonte-montlucon.com
-
yoshii-kuroiwa.com
-
francescaschmeba.com
-
22142chippewalane.com
-
coalitionloop.com
-
gwsalesllc-cincinnati.com
-
heldennews.online
-
sirius-red.com
-
filegate.cloud
-
finchsales.com
-
bedouindirection.com
-
ktnfilm.xyz
-
chicv-app.xyz
-
kakaqiang.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.AgentTesla.ERR.MTB.26943.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.AgentTesla.ERR.MTB.26943.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.AgentTesla.ERR.MTB.26943.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.AgentTesla.ERR.MTB.26943.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1360-59-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1360-60-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1360-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1360-64-0x0000000000890000-0x0000000000B93000-memory.dmp
memory/1928-54-0x0000000000C80000-0x0000000000D30000-memory.dmp
memory/1928-55-0x0000000076011000-0x0000000076013000-memory.dmp
memory/1928-56-0x0000000000580000-0x0000000000598000-memory.dmp
memory/1928-57-0x0000000005EE0000-0x0000000005F52000-memory.dmp
memory/1928-58-0x0000000000BE0000-0x0000000000C10000-memory.dmp