Analysis
- max time kernel
91s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
19/05/2022, 14:37
General
- Target 27fe38ce70fca4c4526c07a42449f11e.exe
- Size 260KB
- Sample220519-ry481abdeq
- SHA256 fe55fb664c32bacbd76bf8859a8a2cd17f23d21f08a22ac9881cb0fa33935990
Score
10/10
Malware Config
Extracted
Family
-
xloader
Version
-
2.6
Campaign
-
be4o
Decoy
-
laboratoriobioixcha.com
-
tictocperushop.online
-
wild-oceans.com
-
belaruscountry.com
-
kicktmall.com
-
fitcoinweb.tech
-
mores.one
-
gogear.one
-
gxrcksy.com
-
samrcq.com
-
impossible-icecream.com
-
bravesxx.com
-
bookchainart.com
-
sleepsolutionsofmboro.com
-
ocbrazilbusinessclub.com
-
advisor76.xyz
-
xitaotech.com
-
mgsdtytifgf3414.xyz
-
johnson-brown.net
-
cr3drt.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\27fe38ce70fca4c4526c07a42449f11e.exe"C:\Users\Admin\AppData\Local\Temp\27fe38ce70fca4c4526c07a42449f11e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 1843⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4380 -ip 43801⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4380-134-0x0000000000620000-0x000000000064B000-memory.dmp
memory/4968-130-0x0000000000C00000-0x0000000000C46000-memory.dmp
memory/4968-131-0x0000000005AB0000-0x0000000006054000-memory.dmp