Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-06-2022 09:41
General
-
Target
SecuriteInfo.com.Trojan.Siggen9.56514.26363.exe
-
Size
579KB
-
MD5
c91aa9a10968348566e1a95d4bb154bf
-
SHA1
163e81732286148d7a343dbb3cfd8955bf508475
-
SHA256
9f84afaa4d50d08f5034c9301cbb906d5856a4851623c2a6fac93da1acad8ef8
-
SHA512
3b67041856e9c6c55f8b495ee9684766f4ea459dc5d28a518a1e8181d0e866be7621ebf1c9da41b998223cb7b36a421c670b6dedaa5f5ca0b4a943ed54f29f19
Malware Config
Extracted
xloader
2.6
a8hq
veteransductcleaning.com
beajtjunkies.com
houseofascofi.com
scottsdalemediator.com
atelyadesign.com
profitcase.pro
imtokenio.club
qinglingpai.com
bigsmile-meal.net
daytonlivestream.com
aspiradores10.online
ytybs120.com
hdatelier.com
bearpierce.com
yeson28ca.com
booklearner.com
m8j9.club
mmophamthinhlegend.space
hq4a7o6zb.com
sophiadaki.online
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.56514.26363.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.56514.26363.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.56514.26363.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.56514.26363.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1032-68-0x0000000071160000-0x0000000071E7D000-memory.dmpFilesize
13.1MB
-
memory/1032-81-0x0000000071160000-0x0000000071E7D000-memory.dmpFilesize
13.1MB
-
memory/1032-56-0x0000000072890000-0x0000000073C1F000-memory.dmpFilesize
19.6MB
-
memory/1032-57-0x0000000071E80000-0x0000000072890000-memory.dmpFilesize
10.1MB
-
memory/1032-58-0x0000000074510000-0x00000000746A4000-memory.dmpFilesize
1.6MB
-
memory/1032-59-0x0000000071160000-0x0000000071E7D000-memory.dmpFilesize
13.1MB
-
memory/1032-60-0x0000000070980000-0x0000000071160000-memory.dmpFilesize
7.9MB
-
memory/1032-61-0x00000000742B0000-0x0000000074481000-memory.dmpFilesize
1.8MB
-
memory/1032-62-0x00000000741B0000-0x00000000742AC000-memory.dmpFilesize
1008KB
-
memory/1032-63-0x0000000000790000-0x000000000079A000-memory.dmpFilesize
40KB
-
memory/1032-64-0x0000000070240000-0x000000007097E000-memory.dmpFilesize
7.2MB
-
memory/1032-65-0x0000000072890000-0x0000000073C1F000-memory.dmpFilesize
19.6MB
-
memory/1032-82-0x00000000742B0000-0x0000000074481000-memory.dmpFilesize
1.8MB
-
memory/1032-55-0x0000000075B71000-0x0000000075B73000-memory.dmpFilesize
8KB
-
memory/1032-66-0x0000000071E80000-0x0000000072890000-memory.dmpFilesize
10.1MB
-
memory/1032-69-0x00000000742B0000-0x0000000074481000-memory.dmpFilesize
1.8MB
-
memory/1032-70-0x0000000004AD0000-0x0000000004B50000-memory.dmpFilesize
512KB
-
memory/1032-71-0x0000000004B50000-0x0000000004B82000-memory.dmpFilesize
200KB
-
memory/1032-54-0x00000000000B0000-0x0000000000148000-memory.dmpFilesize
608KB
-
memory/1032-67-0x0000000074510000-0x00000000746A4000-memory.dmpFilesize
1.6MB
-
memory/1032-79-0x0000000074510000-0x00000000746A4000-memory.dmpFilesize
1.6MB
-
memory/1032-78-0x0000000071E80000-0x0000000072890000-memory.dmpFilesize
10.1MB
-
memory/1032-77-0x0000000072890000-0x0000000073C1F000-memory.dmpFilesize
19.6MB
-
memory/1664-76-0x000000000041F2C0-mapping.dmp
-
memory/1664-75-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1664-73-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1664-80-0x00000000008F0000-0x0000000000BF3000-memory.dmpFilesize
3.0MB
-
memory/1664-72-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB