Analysis
- max time kernel
143s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
04/05/2022, 04:31
General
- Target SecuriteInfo.com.Trojan.MSIL.AgentTesla.ERR.MTB.26943.exe
- Size 687KB
- Sample220504-e5c2wadaf6
- SHA256 06bdc739d26559129afbc157dff8ef0f616dbe885a6cd8a2f43b62efaf848bb9
Malware Config
Extracted
-
xloader
-
2.5
-
mexq
-
universopromocionales.info
-
24-7-solutions.com
-
procofun.com
-
shanghaihuamian.com
-
improvabeauty.com
-
khaulahmuadzah.com
-
turbofonte-montlucon.com
-
yoshii-kuroiwa.com
-
francescaschmeba.com
-
22142chippewalane.com
-
coalitionloop.com
-
gwsalesllc-cincinnati.com
-
heldennews.online
-
sirius-red.com
-
filegate.cloud
-
finchsales.com
-
bedouindirection.com
-
ktnfilm.xyz
-
chicv-app.xyz
-
kakaqiang.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.AgentTesla.ERR.MTB.26943.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.AgentTesla.ERR.MTB.26943.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.AgentTesla.ERR.MTB.26943.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.AgentTesla.ERR.MTB.26943.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2408-137-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2408-138-0x0000000001710000-0x0000000001A5A000-memory.dmp
memory/4856-130-0x0000000000DD0000-0x0000000000E80000-memory.dmp
memory/4856-131-0x0000000005D00000-0x00000000062A4000-memory.dmp
memory/4856-132-0x0000000005830000-0x00000000058C2000-memory.dmp
memory/4856-133-0x00000000059C0000-0x00000000059CA000-memory.dmp
memory/4856-134-0x00000000090E0000-0x000000000917C000-memory.dmp
memory/4856-135-0x0000000001500000-0x0000000001566000-memory.dmp