Analysis
- max time kernel
64s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
06/06/2022, 10:52
General
- Target SecuriteInfo.com.Trojan.PWS.Siggen2.36914.14555.exe
- Size 678KB
- Sample220606-mydzlabhap
- SHA256 0793dfe009772f771270e113edc94fc7a19fa5d7f53a3e858f9775319b9d536e
Malware Config
Extracted
-
xloader
-
2.6
-
a2es
-
glutenfreebahrain.com
-
sportrid.com
-
js-films.com
-
cie-revolver.com
-
outsourcinginstitutebd.com
-
roboticsdatascience.com
-
tebrunk.com
-
needgreatwork.com
-
df1b8j2iwbl33n.life
-
voluum-training.com
-
cherna-roza.com
-
xiyouap.com
-
bluefiftyfoundation.com
-
angolettomc.com
-
yhcp225.com
-
keondredejawn.com
-
ifeelsilky.com
-
coraorganizing.com
-
smartmindstutorials.com
-
tanphucuong.info
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.36914.14555.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.36914.14555.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.36914.14555.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.36914.14555.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.36914.14555.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.36914.14555.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.36914.14555.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Siggen2.36914.14555.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1476-130-0x0000000000870000-0x0000000000920000-memory.dmp
memory/1476-131-0x00000000057F0000-0x0000000005D94000-memory.dmp
memory/1476-132-0x00000000052E0000-0x0000000005372000-memory.dmp
memory/1476-133-0x00000000052B0000-0x00000000052BA000-memory.dmp
memory/1476-134-0x0000000008D00000-0x0000000008D9C000-memory.dmp
memory/1476-135-0x0000000009130000-0x0000000009196000-memory.dmp
memory/4780-139-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4780-140-0x0000000000EE0000-0x000000000122A000-memory.dmp
memory/4780-141-0x0000000000EE0000-0x000000000122A000-memory.dmp