Analysis
- max time kernel
68s - max time network
49s - platform
windows7_x64 - resource
win7-20220414-en - submitted
11/05/2022, 18:00
General
- Target SecuriteInfo.com.Variant.MSILHeracles.37963.6224.exe
- Size 564KB
- Sample220511-wlawvaehc8
- SHA256 37708373f6b4deb76e61c7a9c65200bba9f9d7ca7ebcd82d09242dd9231fa072
Malware Config
Extracted
-
xloader
-
2.5
-
snjq
-
codezonesoftware.xyz
-
traexcel.com
-
smalltowncontractors.com
-
classicalequestrianacademy.com
-
jlvip1066.com
-
ovacup.online
-
foodcravings2312.com
-
dbelnlogoro.quest
-
valeriebeijing.com
-
steri-spiral.com
-
envisionpoolsnd.biz
-
adclw.net
-
smartaf5.xyz
-
tech4ad.com
-
trimilos.info
-
blockplace.club
-
gunpowderz.com
-
nayrajewels.com
-
fapcxi.xyz
-
mentication.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.37963.6224.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.37963.6224.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.37963.6224.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.37963.6224.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1592-54-0x0000000000320000-0x00000000003B0000-memory.dmp
memory/1592-55-0x0000000076781000-0x0000000076783000-memory.dmp
memory/1592-56-0x00000000003C0000-0x00000000003D0000-memory.dmp
memory/1592-57-0x0000000005330000-0x00000000053B2000-memory.dmp
memory/1592-58-0x00000000004A0000-0x00000000004D0000-memory.dmp
memory/1708-59-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1708-60-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1708-62-0x0000000000400000-0x000000000042A000-memory.dmp
memory/1708-64-0x0000000000990000-0x0000000000C93000-memory.dmp