Analysis
- max time kernel
49s - max time network
45s - platform
windows7_x64 - resource
win7-20220414-en - submitted
06/06/2022, 10:52
General
- Target SecuriteInfo.com.Trojan.PWS.Siggen2.36914.14555.exe
- Size 678KB
- Sample220606-mydzlabhap
- SHA256 0793dfe009772f771270e113edc94fc7a19fa5d7f53a3e858f9775319b9d536e
Malware Config
Extracted
-
xloader
-
2.6
-
a2es
-
glutenfreebahrain.com
-
sportrid.com
-
js-films.com
-
cie-revolver.com
-
outsourcinginstitutebd.com
-
roboticsdatascience.com
-
tebrunk.com
-
needgreatwork.com
-
df1b8j2iwbl33n.life
-
voluum-training.com
-
cherna-roza.com
-
xiyouap.com
-
bluefiftyfoundation.com
-
angolettomc.com
-
yhcp225.com
-
keondredejawn.com
-
ifeelsilky.com
-
coraorganizing.com
-
smartmindstutorials.com
-
tanphucuong.info
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.36914.14555.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.36914.14555.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.36914.14555.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.36914.14555.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1264-59-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1264-60-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1264-62-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1264-64-0x0000000000990000-0x0000000000C93000-memory.dmp
memory/1708-54-0x0000000000E70000-0x0000000000F20000-memory.dmp
memory/1708-55-0x0000000075A61000-0x0000000075A63000-memory.dmp
memory/1708-56-0x00000000003D0000-0x00000000003E6000-memory.dmp
memory/1708-57-0x0000000007E00000-0x0000000007E8E000-memory.dmp
memory/1708-58-0x00000000005E0000-0x0000000000612000-memory.dmp