Analysis
- max time kernel
184s - max time network
195s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
28/05/2022, 00:32
General
- Target SecuriteInfo.com.Trojan.PackedNET.1159.2750.exe
- Size 585KB
- Sample220528-avmfcaade5
- SHA256 075f41c576c8e20d1ec1981a5e4197d514030c69dd653dfc2b94edf5088a0671
Malware Config
Extracted
-
xloader
-
2.6
-
crqp
-
ftepenrollmyrhbenefit.com
-
maecharlie.com
-
probaganda.com
-
nightclubmontcada.com
-
giapsychic.com
-
hexinchao.com
-
lifelovely.site
-
magiaphotoshop.com
-
taurusafr7o.com
-
loen6.com
-
7drnpc.com
-
caramelshubs.com
-
witiboss.com
-
marketablesecuritycourses.com
-
sunflowerkreationsllc.com
-
bantuancs24jam.com
-
simplecleaningcompany.com
-
fdjzx.com
-
whatdoesxstandfor.com
-
reliableworldnews.net
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1159.2750.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1159.2750.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1159.2750.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1159.2750.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2552-130-0x0000000000CA0000-0x0000000000D38000-memory.dmp
memory/2552-131-0x0000000005E30000-0x00000000063D4000-memory.dmp
memory/2552-132-0x0000000005880000-0x0000000005912000-memory.dmp
memory/2552-133-0x0000000005CB0000-0x0000000005D4C000-memory.dmp
memory/2552-134-0x0000000006750000-0x00000000067B6000-memory.dmp
memory/3392-136-0x0000000000400000-0x000000000042B000-memory.dmp
memory/3392-137-0x0000000001690000-0x00000000019DA000-memory.dmp