Analysis
- max time kernel
65s - max time network
43s - platform
windows7_x64 - resource
win7-20220414-en - submitted
01/06/2022, 04:37
General
- Target SecuriteInfo.com.Variant.Tedy.132024.17667.exe
- Size 592KB
- Sample220601-e8s79saaaq
- SHA256 441c12b87bca3daf36a571d93fa052b1cb47d9f6b1f80ef22ead84a1961ec66d
Malware Config
Extracted
-
xloader
-
2.6
-
mwfc
-
nonzamoto.com
-
bullshitcasting.com
-
glacieverifme.site
-
kingdomvisionarychallenge.com
-
selalujos.com
-
lanling88.com
-
chronotalent.com
-
thebossmaker.com
-
lyjzfwy.com
-
oneulbada.net
-
vintogel88.com
-
grimoirestudio.store
-
williamlathamllc.com
-
enciphor.com
-
weukrainians.com
-
onandoffsite.com
-
goldstorage.cloud
-
incredibuildx.com
-
verantheacodex.com
-
blavktux.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.132024.17667.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.132024.17667.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.132024.17667.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.132024.17667.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.132024.17667.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.132024.17667.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/956-71-0x0000000000400000-0x000000000042B000-memory.dmp
memory/956-79-0x0000000000840000-0x0000000000B43000-memory.dmp
memory/956-74-0x0000000000400000-0x000000000042B000-memory.dmp
memory/956-72-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2024-68-0x000000006FB60000-0x000000006FD31000-memory.dmp
memory/2024-70-0x0000000000700000-0x0000000000732000-memory.dmp
memory/2024-61-0x0000000070480000-0x0000000070C60000-memory.dmp
memory/2024-62-0x000000006FD40000-0x000000007047E000-memory.dmp
memory/2024-63-0x00000000005D0000-0x00000000005E6000-memory.dmp
memory/2024-64-0x0000000072390000-0x000000007371F000-memory.dmp
memory/2024-65-0x0000000071980000-0x0000000072390000-memory.dmp
memory/2024-66-0x0000000070C60000-0x000000007197D000-memory.dmp
memory/2024-67-0x0000000073FF0000-0x0000000074184000-memory.dmp
memory/2024-54-0x0000000000E50000-0x0000000000EEA000-memory.dmp
memory/2024-69-0x0000000005E40000-0x0000000005ECE000-memory.dmp
memory/2024-60-0x0000000073EF0000-0x0000000073FEC000-memory.dmp
memory/2024-59-0x0000000070C60000-0x000000007197D000-memory.dmp
memory/2024-58-0x0000000074DD1000-0x0000000074DD3000-memory.dmp
memory/2024-57-0x0000000073FF0000-0x0000000074184000-memory.dmp
memory/2024-56-0x0000000071980000-0x0000000072390000-memory.dmp
memory/2024-76-0x0000000072390000-0x000000007371F000-memory.dmp
memory/2024-77-0x0000000073FF0000-0x0000000074184000-memory.dmp
memory/2024-78-0x0000000071980000-0x0000000072390000-memory.dmp
memory/2024-55-0x0000000072390000-0x000000007371F000-memory.dmp
memory/2024-80-0x0000000070C60000-0x000000007197D000-memory.dmp
memory/2024-81-0x000000006FB60000-0x000000006FD31000-memory.dmp
memory/2024-82-0x000000006F900000-0x000000006FA23000-memory.dmp