Analysis
- max time kernel
147s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
17/06/2022, 04:18
General
- Target PO 87910219.exe
- Size 617KB
- Sample220617-ewx1pache3
- SHA256 774e7baca6802b4d8cf3df0fd6162e1bac6dbfb5a4e50f09bc2d7c9e166b285e
Malware Config
Extracted
-
xloader
-
2.6
-
ssmm
-
bhealthybu.com
-
formasyonlar.com
-
huddleadvising.com
-
iroofer.net
-
pokerisparadise.com
-
partnrsocial.com
-
omnixinity.com
-
sandibet.biz
-
xxxpool.xyz
-
mainsuranceagency.com
-
filipkaarrtofffers.online
-
txgongsi.com
-
bonasuplementos.com
-
sxp89app.space
-
grandeurjewelryph.com
-
productsorcerer.com
-
mrussellhandyman.com
-
igorstelea.com
-
cateraevents.com
-
yashaswistudio.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 4 IoCs
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Program Files directory 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 87910219.exe"C:\Users\Admin\AppData\Local\Temp\PO 87910219.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO 87910219.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO 87910219.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
DB1
DB1
memory/672-148-0x0000000007670000-0x000000000777D000-memory.dmp
memory/672-150-0x0000000007670000-0x000000000777D000-memory.dmp
memory/672-141-0x00000000032E0000-0x000000000342C000-memory.dmp
memory/2208-136-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2208-138-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2208-139-0x0000000001520000-0x000000000186A000-memory.dmp
memory/2208-140-0x0000000001460000-0x0000000001471000-memory.dmp
memory/2644-134-0x0000000002BC0000-0x0000000002BCA000-memory.dmp
memory/2644-130-0x0000000000600000-0x00000000006A0000-memory.dmp
memory/2644-133-0x00000000051B0000-0x000000000524C000-memory.dmp
memory/2644-132-0x0000000005110000-0x00000000051A2000-memory.dmp
memory/2644-131-0x00000000056C0000-0x0000000005C64000-memory.dmp
memory/4600-143-0x0000000001450000-0x000000000146E000-memory.dmp
memory/4600-149-0x0000000001370000-0x000000000139B000-memory.dmp
memory/4600-147-0x0000000001B40000-0x0000000001BD0000-memory.dmp
memory/4600-146-0x0000000001C60000-0x0000000001FAA000-memory.dmp
memory/4600-144-0x0000000001370000-0x000000000139B000-memory.dmp