Analysis
- max time kernel
43s - max time network
47s - platform
windows7_x64 - resource
win7-20220414-en - submitted
03/06/2022, 09:41
General
- Target SecuriteInfo.com.Trojan.Siggen9.56514.26363.exe
- Size 579KB
- Sample220603-lnrx2aaaaj
- SHA256 9f84afaa4d50d08f5034c9301cbb906d5856a4851623c2a6fac93da1acad8ef8
Malware Config
Extracted
-
xloader
-
2.6
-
a8hq
-
veteransductcleaning.com
-
beajtjunkies.com
-
houseofascofi.com
-
scottsdalemediator.com
-
atelyadesign.com
-
profitcase.pro
-
imtokenio.club
-
qinglingpai.com
-
bigsmile-meal.net
-
daytonlivestream.com
-
aspiradores10.online
-
ytybs120.com
-
hdatelier.com
-
bearpierce.com
-
yeson28ca.com
-
booklearner.com
-
m8j9.club
-
mmophamthinhlegend.space
-
hq4a7o6zb.com
-
sophiadaki.online
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.56514.26363.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.56514.26363.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.56514.26363.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.56514.26363.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1032-68-0x0000000071160000-0x0000000071E7D000-memory.dmp
memory/1032-78-0x0000000071E80000-0x0000000072890000-memory.dmp
memory/1032-56-0x0000000072890000-0x0000000073C1F000-memory.dmp
memory/1032-57-0x0000000071E80000-0x0000000072890000-memory.dmp
memory/1032-54-0x00000000000B0000-0x0000000000148000-memory.dmp
memory/1032-59-0x0000000071160000-0x0000000071E7D000-memory.dmp
memory/1032-60-0x0000000070980000-0x0000000071160000-memory.dmp
memory/1032-61-0x00000000742B0000-0x0000000074481000-memory.dmp
memory/1032-62-0x00000000741B0000-0x00000000742AC000-memory.dmp
memory/1032-63-0x0000000000790000-0x000000000079A000-memory.dmp
memory/1032-64-0x0000000070240000-0x000000007097E000-memory.dmp
memory/1032-65-0x0000000072890000-0x0000000073C1F000-memory.dmp
memory/1032-55-0x0000000075B71000-0x0000000075B73000-memory.dmp
memory/1032-66-0x0000000071E80000-0x0000000072890000-memory.dmp
memory/1032-58-0x0000000074510000-0x00000000746A4000-memory.dmp
memory/1032-69-0x00000000742B0000-0x0000000074481000-memory.dmp
memory/1032-70-0x0000000004AD0000-0x0000000004B50000-memory.dmp
memory/1032-71-0x0000000004B50000-0x0000000004B82000-memory.dmp
memory/1032-82-0x00000000742B0000-0x0000000074481000-memory.dmp
memory/1032-81-0x0000000071160000-0x0000000071E7D000-memory.dmp
memory/1032-79-0x0000000074510000-0x00000000746A4000-memory.dmp
memory/1032-67-0x0000000074510000-0x00000000746A4000-memory.dmp
memory/1032-77-0x0000000072890000-0x0000000073C1F000-memory.dmp
memory/1664-75-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1664-73-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1664-80-0x00000000008F0000-0x0000000000BF3000-memory.dmp
memory/1664-72-0x0000000000400000-0x000000000042B000-memory.dmp