Analysis
- max time kernel
71s - max time network
51s - platform
windows7_x64 - resource
win7-20220414-en - submitted
28/05/2022, 00:32
General
- Target SecuriteInfo.com.Trojan.PackedNET.1159.2750.exe
- Size 585KB
- Sample220528-avmfcaade5
- SHA256 075f41c576c8e20d1ec1981a5e4197d514030c69dd653dfc2b94edf5088a0671
Malware Config
Extracted
-
xloader
-
2.6
-
crqp
-
ftepenrollmyrhbenefit.com
-
maecharlie.com
-
probaganda.com
-
nightclubmontcada.com
-
giapsychic.com
-
hexinchao.com
-
lifelovely.site
-
magiaphotoshop.com
-
taurusafr7o.com
-
loen6.com
-
7drnpc.com
-
caramelshubs.com
-
witiboss.com
-
marketablesecuritycourses.com
-
sunflowerkreationsllc.com
-
bantuancs24jam.com
-
simplecleaningcompany.com
-
fdjzx.com
-
whatdoesxstandfor.com
-
reliableworldnews.net
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1159.2750.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1159.2750.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1159.2750.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1159.2750.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/824-70-0x0000000074920000-0x0000000074AB4000-memory.dmp
memory/824-71-0x00000000715C0000-0x00000000722DD000-memory.dmp
memory/824-56-0x0000000075741000-0x0000000075743000-memory.dmp
memory/824-57-0x0000000072CF0000-0x000000007407F000-memory.dmp
memory/824-58-0x00000000722E0000-0x0000000072CF0000-memory.dmp
memory/824-59-0x0000000074920000-0x0000000074AB4000-memory.dmp
memory/824-60-0x00000000715C0000-0x00000000722DD000-memory.dmp
memory/824-61-0x0000000005500000-0x000000000558E000-memory.dmp
memory/824-62-0x0000000001E80000-0x0000000001EB2000-memory.dmp
memory/824-76-0x0000000070DE0000-0x00000000715C0000-memory.dmp
memory/824-55-0x0000000000740000-0x000000000075E000-memory.dmp
memory/824-75-0x0000000070DE0000-0x00000000715C0000-memory.dmp
memory/824-74-0x0000000074330000-0x0000000074453000-memory.dmp
memory/824-68-0x0000000072CF0000-0x000000007407F000-memory.dmp
memory/824-69-0x00000000722E0000-0x0000000072CF0000-memory.dmp
memory/824-54-0x0000000000840000-0x00000000008D8000-memory.dmp
memory/824-72-0x0000000074720000-0x00000000748F1000-memory.dmp
memory/956-73-0x0000000000BD0000-0x0000000000ED3000-memory.dmp
memory/956-64-0x0000000000400000-0x000000000042B000-memory.dmp
memory/956-63-0x0000000000400000-0x000000000042B000-memory.dmp
memory/956-66-0x0000000000400000-0x000000000042B000-memory.dmp