Analysis
- max time kernel
149s - max time network
151s - platform
windows7_x64 - resource
win7-20220414-en - submitted
25/05/2022, 22:24
General
- Target see7.exe
- Size 574KB
- Sample220525-2bc64sabbj
- SHA256 513624286483a4e172511b412b82445a06eefc904d54de75da656ec1a6f8ae99
Malware Config
Extracted
-
xloader
-
2.6
-
eido
-
revellbb.com
-
tempranillowine.net
-
viralstrategies.info
-
blacktxu.com
-
flfththirdbank.com
-
vaoex.com
-
theselfdirectedinvestor.com
-
vinadelmar.travel
-
othersidejimmythemonkey.com
-
jaguar-landrovercenter-graz.com
-
supremeosterreich.com
-
chatsubs.com
-
free99.design
-
serviciosmvs.com
-
bongmecams.xyz
-
malikwoodson.com
-
onlinegamebox.club
-
694624.com
-
yeezyzapatos.club
-
istanbul-hairtransplant.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 4 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\see7.exe"C:\Users\Admin\AppData\Local\Temp\see7.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\see7.exe"C:\Users\Admin\AppData\Local\Temp\see7.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\see7.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1268-76-0x00000000066A0000-0x0000000006786000-memory.dmp
memory/1268-68-0x00000000041E0000-0x0000000004290000-memory.dmp
memory/1756-56-0x0000000000610000-0x0000000000628000-memory.dmp
memory/1756-57-0x0000000004970000-0x00000000049E4000-memory.dmp
memory/1756-58-0x0000000002050000-0x0000000002082000-memory.dmp
memory/1756-54-0x0000000000890000-0x000000000092A000-memory.dmp
memory/1756-55-0x00000000750C1000-0x00000000750C3000-memory.dmp
memory/1868-75-0x0000000001EA0000-0x0000000001F30000-memory.dmp
memory/1868-74-0x00000000020E0000-0x00000000023E3000-memory.dmp
memory/1868-72-0x0000000000090000-0x00000000000BB000-memory.dmp
memory/1868-71-0x0000000000860000-0x0000000000878000-memory.dmp
memory/2036-59-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2036-66-0x0000000000BF0000-0x0000000000EF3000-memory.dmp
memory/2036-67-0x00000000001D0000-0x00000000001E1000-memory.dmp
memory/2036-65-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2036-62-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2036-60-0x0000000000400000-0x000000000042B000-memory.dmp