request for quotation samples No 48576935 96877463.exe
419KB
21-05-2022 04:19
behavioral1
6ceb03b6435eefad76639a03a22ce0fb
f1a37e2f2cc7de7eed2403af42a446050a6610fd
b32579e01c28fc0a157f14ce8c679d02fcd1f5c03f8eef56ba6a77a627786d84
1987f6e1573ace6e6fa2b4c4409e7af1d7db12ab40593c8898a12c135aa0168c7772ae1727072e867311f4bd068a40b49c996102a05f80d5618de0f76d8b330b
Extracted
| Family | xloader |
| Version | 2.1 |
| Campaign | iwnn |
| Decoy |
laerteskft.com growingstrongbook.com bridgecounsel.com takeabreakfromwork.com www2998s.com rvaimportados.com zelfstandigondernemen.online connectinglifes.com ecopt.win bwwvuih.com designingbeyondmyeloma.com apprentisageaplus.com walkintubstoday.sale littlemexicoimports.com getaltai.com sbd55999.com nu000.com theconsciouscookingcompany.com jelancer.com osusume-toushiseminar.com grandis16v.info venturacaraccidentattorney.com shadesofunity.com shinephotographydesign.com sportweights.net duki.ltd dutchlion.solutions blockshow.info property-shark.com yourgolfersagent.com heatingtoken.com mrhira.com ncmkwd.info immobilier-1800.com aloyadakmashin.com xn--polticadelopersonal-n1b.com nbgadgets.com brightwaycapecoral.com metrocommunitynews.com thegirlwithmightyinks.com 7380pe.com ondemandleadsagency.com kysaves529.com microgreensprout.com progressivecarlogin.com freemifr.com danielzig.com greathomes8.com lzsmsm.com denverpropertybrothers.com |
Filter: none
-
Xloader
Description
Xloader is a rebranded version of Formbook malware.
Tags
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
Description
suricata: ET MALWARE FormBook CnC Checkin (GET)
Tags
-
Xloader Payload
Tags
Reported IOCs
resource yara_rule behavioral1/memory/2020-63-0x000000000041CB00-mapping.dmp xloader behavioral1/memory/2020-62-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/2020-65-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1392-71-0x0000000000070000-0x0000000000098000-memory.dmp xloader -
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Suspicious use of SetThreadContextrequest for quotation samples No 48576935 96877463.exerequest for quotation samples No 48576935 96877463.exewscript.exe
Reported IOCs
description pid process target process PID 1776 set thread context of 2020 1776 request for quotation samples No 48576935 96877463.exe request for quotation samples No 48576935 96877463.exe PID 2020 set thread context of 1220 2020 request for quotation samples No 48576935 96877463.exe Explorer.EXE PID 1392 set thread context of 1220 1392 wscript.exe Explorer.EXE -
Modifies Internet Explorer settingswscript.exe
Tags
TTPs
Reported IOCs
description ioc process Key created \Registry\User\S-1-5-21-2277218442-1199762539-2004043321-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wscript.exe -
Suspicious behavior: EnumeratesProcessesrequest for quotation samples No 48576935 96877463.exerequest for quotation samples No 48576935 96877463.exewscript.exe
Reported IOCs
pid process 1776 request for quotation samples No 48576935 96877463.exe 2020 request for quotation samples No 48576935 96877463.exe 2020 request for quotation samples No 48576935 96877463.exe 1392 wscript.exe 1392 wscript.exe 1392 wscript.exe 1392 wscript.exe 1392 wscript.exe 1392 wscript.exe 1392 wscript.exe 1392 wscript.exe 1392 wscript.exe 1392 wscript.exe 1392 wscript.exe 1392 wscript.exe 1392 wscript.exe 1392 wscript.exe -
Suspicious behavior: MapViewOfSectionrequest for quotation samples No 48576935 96877463.exewscript.exe
Reported IOCs
pid process 2020 request for quotation samples No 48576935 96877463.exe 2020 request for quotation samples No 48576935 96877463.exe 2020 request for quotation samples No 48576935 96877463.exe 1392 wscript.exe 1392 wscript.exe 1392 wscript.exe 1392 wscript.exe -
Suspicious use of AdjustPrivilegeTokenrequest for quotation samples No 48576935 96877463.exerequest for quotation samples No 48576935 96877463.exewscript.exeExplorer.EXE
Reported IOCs
description pid process Token: SeDebugPrivilege 1776 request for quotation samples No 48576935 96877463.exe Token: SeDebugPrivilege 2020 request for quotation samples No 48576935 96877463.exe Token: SeDebugPrivilege 1392 wscript.exe Token: SeShutdownPrivilege 1220 Explorer.EXE -
Suspicious use of FindShellTrayWindowExplorer.EXE
Reported IOCs
pid process 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SendNotifyMessageExplorer.EXE
Reported IOCs
pid process 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of WriteProcessMemoryrequest for quotation samples No 48576935 96877463.exeExplorer.EXEwscript.exe
Reported IOCs
description pid process target process PID 1776 wrote to memory of 2004 1776 request for quotation samples No 48576935 96877463.exe request for quotation samples No 48576935 96877463.exe PID 1776 wrote to memory of 2004 1776 request for quotation samples No 48576935 96877463.exe request for quotation samples No 48576935 96877463.exe PID 1776 wrote to memory of 2004 1776 request for quotation samples No 48576935 96877463.exe request for quotation samples No 48576935 96877463.exe PID 1776 wrote to memory of 2004 1776 request for quotation samples No 48576935 96877463.exe request for quotation samples No 48576935 96877463.exe PID 1776 wrote to memory of 2020 1776 request for quotation samples No 48576935 96877463.exe request for quotation samples No 48576935 96877463.exe PID 1776 wrote to memory of 2020 1776 request for quotation samples No 48576935 96877463.exe request for quotation samples No 48576935 96877463.exe PID 1776 wrote to memory of 2020 1776 request for quotation samples No 48576935 96877463.exe request for quotation samples No 48576935 96877463.exe PID 1776 wrote to memory of 2020 1776 request for quotation samples No 48576935 96877463.exe request for quotation samples No 48576935 96877463.exe PID 1776 wrote to memory of 2020 1776 request for quotation samples No 48576935 96877463.exe request for quotation samples No 48576935 96877463.exe PID 1776 wrote to memory of 2020 1776 request for quotation samples No 48576935 96877463.exe request for quotation samples No 48576935 96877463.exe PID 1776 wrote to memory of 2020 1776 request for quotation samples No 48576935 96877463.exe request for quotation samples No 48576935 96877463.exe PID 1220 wrote to memory of 1392 1220 Explorer.EXE wscript.exe PID 1220 wrote to memory of 1392 1220 Explorer.EXE wscript.exe PID 1220 wrote to memory of 1392 1220 Explorer.EXE wscript.exe PID 1220 wrote to memory of 1392 1220 Explorer.EXE wscript.exe PID 1392 wrote to memory of 368 1392 wscript.exe Firefox.exe PID 1392 wrote to memory of 368 1392 wscript.exe Firefox.exe PID 1392 wrote to memory of 368 1392 wscript.exe Firefox.exe PID 1392 wrote to memory of 368 1392 wscript.exe Firefox.exe PID 1392 wrote to memory of 368 1392 wscript.exe Firefox.exe
-
C:\Windows\Explorer.EXEPID:1220C:\Windows\Explorer.EXESuspicious use of AdjustPrivilegeTokenSuspicious use of FindShellTrayWindowSuspicious use of SendNotifyMessageSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\request for quotation samples No 48576935 96877463.exePID:1776"C:\Users\Admin\AppData\Local\Temp\request for quotation samples No 48576935 96877463.exe"Suspicious use of SetThreadContextSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\request for quotation samples No 48576935 96877463.exePID:2004"C:\Users\Admin\AppData\Local\Temp\request for quotation samples No 48576935 96877463.exe"
-
C:\Users\Admin\AppData\Local\Temp\request for quotation samples No 48576935 96877463.exePID:2020"C:\Users\Admin\AppData\Local\Temp\request for quotation samples No 48576935 96877463.exe"Suspicious use of SetThreadContextSuspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSectionSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exePID:1392"C:\Windows\SysWOW64\wscript.exe"Suspicious use of SetThreadContextModifies Internet Explorer settingsSuspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSectionSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exePID:368"C:\Program Files\Mozilla Firefox\Firefox.exe"
-
memory/1220-68-0x00000000060B0000-0x0000000006196000-memory.dmp
-
memory/1220-74-0x00000000061A0000-0x00000000062C1000-memory.dmp
-
memory/1392-71-0x0000000000070000-0x0000000000098000-memory.dmp
-
memory/1392-70-0x0000000000C20000-0x0000000000C46000-memory.dmp
-
memory/1392-69-0x0000000000000000-mapping.dmp
-
memory/1392-73-0x0000000000370000-0x00000000003FF000-memory.dmp
-
memory/1392-72-0x00000000021E0000-0x00000000024E3000-memory.dmp
-
memory/1776-55-0x00000000761F1000-0x00000000761F3000-memory.dmp
-
memory/1776-56-0x00000000003F0000-0x0000000000402000-memory.dmp
-
memory/1776-57-0x0000000005490000-0x00000000054D8000-memory.dmp
-
memory/1776-58-0x00000000054D0000-0x00000000054FE000-memory.dmp
-
memory/1776-54-0x0000000001010000-0x0000000001080000-memory.dmp
-
memory/2020-67-0x0000000000130000-0x0000000000140000-memory.dmp
-
memory/2020-66-0x0000000000910000-0x0000000000C13000-memory.dmp
-
memory/2020-62-0x0000000000400000-0x0000000000428000-memory.dmp
-
memory/2020-63-0x000000000041CB00-mapping.dmp
-
memory/2020-60-0x0000000000400000-0x0000000000428000-memory.dmp
-
memory/2020-59-0x0000000000400000-0x0000000000428000-memory.dmp
-
memory/2020-65-0x0000000000400000-0x0000000000428000-memory.dmp