Analysis
- max time kernel
91s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
27/06/2022, 08:53
General
- Target d1f47fde475a365160c90907b192f5fe.exe
- Size 754KB
- Sample220627-kta12aaaap
- SHA256 659e83e55702067d1a62f082238c752daf8b35e7eb66454cafb47b6618610009
Malware Config
Extracted
-
xloader
-
2.6
-
ip4t
-
710wgm.com
-
ournewhorizon.com
-
hilfe-online.xyz
-
suryaciptanusantara.com
-
hfrdwy.com
-
solutionscollection.com
-
savor.menu
-
fxivcama.com
-
freedom-recruitment.com
-
owldit.com
-
fullbiz.online
-
ztgifts.com
-
zerlastreeservices.com
-
simpleenergyai.com
-
ostheide-immobilien.com
-
mike-piano.com
-
xiheps.com
-
usedcarindonesia-ace.com
-
yuncuiyunying.xyz
-
hopecrtprotour.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1f47fde475a365160c90907b192f5fe.exe"C:\Users\Admin\AppData\Local\Temp\d1f47fde475a365160c90907b192f5fe.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d1f47fde475a365160c90907b192f5fe.exe"C:\Users\Admin\AppData\Local\Temp\d1f47fde475a365160c90907b192f5fe.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2604-136-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2604-137-0x0000000001010000-0x000000000135A000-memory.dmp
memory/3548-130-0x0000000000B10000-0x0000000000BD2000-memory.dmp
memory/3548-131-0x0000000005830000-0x0000000005DD4000-memory.dmp
memory/3548-132-0x0000000005320000-0x00000000053B2000-memory.dmp
memory/3548-133-0x00000000053C0000-0x000000000545C000-memory.dmp
memory/3548-134-0x0000000009450000-0x000000000945A000-memory.dmp