Analysis
- max time kernel
44s - max time network
48s - platform
windows7_x64 - resource
win7-20220414-en - submitted
27/06/2022, 08:53
General
- Target d1f47fde475a365160c90907b192f5fe.exe
- Size 754KB
- Sample220627-kta12aaaap
- SHA256 659e83e55702067d1a62f082238c752daf8b35e7eb66454cafb47b6618610009
Malware Config
Extracted
-
xloader
-
2.6
-
ip4t
-
710wgm.com
-
ournewhorizon.com
-
hilfe-online.xyz
-
suryaciptanusantara.com
-
hfrdwy.com
-
solutionscollection.com
-
savor.menu
-
fxivcama.com
-
freedom-recruitment.com
-
owldit.com
-
fullbiz.online
-
ztgifts.com
-
zerlastreeservices.com
-
simpleenergyai.com
-
ostheide-immobilien.com
-
mike-piano.com
-
xiheps.com
-
usedcarindonesia-ace.com
-
yuncuiyunying.xyz
-
hopecrtprotour.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1f47fde475a365160c90907b192f5fe.exe"C:\Users\Admin\AppData\Local\Temp\d1f47fde475a365160c90907b192f5fe.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d1f47fde475a365160c90907b192f5fe.exe"C:\Users\Admin\AppData\Local\Temp\d1f47fde475a365160c90907b192f5fe.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1712-59-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1712-60-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1712-62-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1712-64-0x0000000000830000-0x0000000000B33000-memory.dmp
memory/2028-54-0x0000000000BD0000-0x0000000000C92000-memory.dmp
memory/2028-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp
memory/2028-56-0x00000000005C0000-0x00000000005F4000-memory.dmp
memory/2028-57-0x0000000000A30000-0x0000000000A4A000-memory.dmp
memory/2028-58-0x0000000000A90000-0x0000000000A96000-memory.dmp