Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
25/05/2022, 22:24
General
- Target see7.exe
- Size 574KB
- Sample220525-2bc64sabbj
- SHA256 513624286483a4e172511b412b82445a06eefc904d54de75da656ec1a6f8ae99
Malware Config
Extracted
-
xloader
-
2.6
-
eido
-
revellbb.com
-
tempranillowine.net
-
viralstrategies.info
-
blacktxu.com
-
flfththirdbank.com
-
vaoex.com
-
theselfdirectedinvestor.com
-
vinadelmar.travel
-
othersidejimmythemonkey.com
-
jaguar-landrovercenter-graz.com
-
supremeosterreich.com
-
chatsubs.com
-
free99.design
-
serviciosmvs.com
-
bongmecams.xyz
-
malikwoodson.com
-
onlinegamebox.club
-
694624.com
-
yeezyzapatos.club
-
istanbul-hairtransplant.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\see7.exe"C:\Users\Admin\AppData\Local\Temp\see7.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\see7.exe"C:\Users\Admin\AppData\Local\Temp\see7.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\see7.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1816-140-0x00000000012E0000-0x00000000012F1000-memory.dmp
memory/1816-138-0x00000000013C0000-0x000000000170A000-memory.dmp
memory/1816-137-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2380-143-0x0000000000F30000-0x0000000000F37000-memory.dmp
memory/2380-145-0x0000000000F40000-0x000000000128A000-memory.dmp
memory/2380-147-0x0000000000A70000-0x0000000000B00000-memory.dmp
memory/2380-144-0x00000000004B0000-0x00000000004DB000-memory.dmp
memory/2480-141-0x00000000026E0000-0x0000000002879000-memory.dmp
memory/2480-148-0x0000000002AD0000-0x0000000002BB0000-memory.dmp
memory/2988-131-0x0000000007D10000-0x00000000082B4000-memory.dmp
memory/2988-132-0x0000000007860000-0x00000000078F2000-memory.dmp
memory/2988-130-0x0000000000950000-0x00000000009EA000-memory.dmp
memory/2988-133-0x0000000007900000-0x000000000790A000-memory.dmp
memory/2988-135-0x000000000B780000-0x000000000B7E6000-memory.dmp
memory/2988-134-0x000000000B5A0000-0x000000000B63C000-memory.dmp