Analysis
- max time kernel
148s - max time network
152s - platform
windows7_x64 - resource
win7-20220414-en - submitted
05/06/2022, 11:03
General
- Target 5daed332426c66a3852518126bc49dfe.exe
- Size 317KB
- Sample220605-m5nsdaaac2
- SHA256 12fd506bab09a036a69b32535df6392d533a5ad8112c8b7bf287647f8c032bb0
Malware Config
Extracted
-
xloader
-
2.5
-
ocgr
-
shiftmedicalstaffing.agency
-
muktobangla.xyz
-
attmleather.com
-
modelahs.com
-
clime.email
-
yonatec.com
-
mftie.com
-
doxofcolor.com
-
american-atlantic.net
-
christineenergy.com
-
fjqsdz.com
-
nagpurmandarin.com
-
hofwimmer.com
-
gororidev.com
-
china-eros.com
-
xn--ekrt15fxyb2t2c.xn--czru2d
-
dabsavy.com
-
buggy4t.com
-
souplant.com
-
insurancewineappraisals.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 5 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5daed332426c66a3852518126bc49dfe.exe"C:\Users\Admin\AppData\Local\Temp\5daed332426c66a3852518126bc49dfe.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/956-77-0x0000000000070000-0x0000000000099000-memory.dmp
memory/956-75-0x0000000000440000-0x00000000004D0000-memory.dmp
memory/956-74-0x0000000000070000-0x0000000000099000-memory.dmp
memory/956-73-0x00000000020F0000-0x00000000023F3000-memory.dmp
memory/956-72-0x00000000005C0000-0x00000000005E2000-memory.dmp
memory/1208-68-0x0000000005EF0000-0x0000000006016000-memory.dmp
memory/1208-78-0x0000000004110000-0x00000000041E0000-memory.dmp
memory/1208-76-0x0000000004110000-0x00000000041E0000-memory.dmp
memory/1844-59-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1844-67-0x0000000000210000-0x0000000000221000-memory.dmp
memory/1844-66-0x0000000000930000-0x0000000000C33000-memory.dmp
memory/1844-70-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1844-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1844-60-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1868-64-0x0000000071F90000-0x000000007331F000-memory.dmp
memory/1868-54-0x0000000000D80000-0x0000000000DD2000-memory.dmp
memory/1868-58-0x0000000071F90000-0x000000007331F000-memory.dmp
memory/1868-57-0x0000000071580000-0x0000000071F90000-memory.dmp
memory/1868-56-0x0000000071F90000-0x000000007331F000-memory.dmp
memory/1868-55-0x0000000000320000-0x0000000000354000-memory.dmp