Analysis
- max time kernel
91s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
03/06/2022, 09:41
General
- Target SecuriteInfo.com.Trojan.Siggen9.56514.26363.exe
- Size 579KB
- Sample220603-lnrx2aaaaj
- SHA256 9f84afaa4d50d08f5034c9301cbb906d5856a4851623c2a6fac93da1acad8ef8
Malware Config
Extracted
-
xloader
-
2.6
-
a8hq
-
veteransductcleaning.com
-
beajtjunkies.com
-
houseofascofi.com
-
scottsdalemediator.com
-
atelyadesign.com
-
profitcase.pro
-
imtokenio.club
-
qinglingpai.com
-
bigsmile-meal.net
-
daytonlivestream.com
-
aspiradores10.online
-
ytybs120.com
-
hdatelier.com
-
bearpierce.com
-
yeson28ca.com
-
booklearner.com
-
m8j9.club
-
mmophamthinhlegend.space
-
hq4a7o6zb.com
-
sophiadaki.online
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.56514.26363.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.56514.26363.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.56514.26363.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/228-136-0x0000000000400000-0x000000000042B000-memory.dmp
memory/228-137-0x00000000019A0000-0x0000000001CEA000-memory.dmp
memory/3416-130-0x0000000000A20000-0x0000000000AB8000-memory.dmp
memory/3416-131-0x0000000005AB0000-0x0000000006054000-memory.dmp
memory/3416-132-0x0000000005450000-0x00000000054E2000-memory.dmp
memory/3416-133-0x00000000055A0000-0x000000000563C000-memory.dmp
memory/3416-134-0x0000000005430000-0x000000000543A000-memory.dmp