Analysis
- max time kernel
49s - max time network
51s - platform
windows7_x64 - resource
win7-20220414-en - submitted
06/06/2022, 10:52
General
- Target SecuriteInfo.com.Trojan.PackedNET.1367.10412.exe
- Size 622KB
- Sample220606-mydzlabham
- SHA256 fc753d6a1adb745147ae129b7745f4d5bdb7c02fcad71e96bb40b305ca0b45b8
Malware Config
Extracted
-
xloader
-
2.6
-
tdht
-
marcosmc.com
-
theknicksfix.com
-
skjgjs.com
-
blacktuxs.com
-
monanimaldecompanie.com
-
initiummallsquare.com
-
bleekvandaag.online
-
ultimatestoragelimited.com
-
caobatins.com
-
sun-mirror.ink
-
eclbet.download
-
kiewitus.com
-
mtgeezer.com
-
sar-partners.com
-
aedregistrations.com
-
hpsebz.online
-
akaxai.com
-
endtoendengineering.com
-
sorayadossantos.com
-
lj2d6dd39.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1367.10412.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1367.10412.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1367.10412.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.1367.10412.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/632-54-0x0000000001020000-0x00000000010C2000-memory.dmp
memory/632-55-0x0000000075391000-0x0000000075393000-memory.dmp
memory/632-56-0x00000000006B0000-0x00000000006C6000-memory.dmp
memory/632-57-0x0000000005760000-0x00000000057EE000-memory.dmp
memory/632-58-0x0000000000C90000-0x0000000000CC2000-memory.dmp
memory/1228-59-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1228-60-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1228-62-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1228-64-0x0000000000830000-0x0000000000B33000-memory.dmp