Analysis
- max time kernel
152s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
28/06/2022, 19:24
General
- Target tmp.exe
- Size 924KB
- Sample220628-x4jgdadfd7
- SHA256 b742fa6347613773ab172e17d85e43d66036a4b3a037a13aa7acaae631075e8f
Malware Config
Extracted
-
xloader
-
2.6
-
dni3
-
controlgaming.net
-
tidbitbakery.com
-
dialsquareproperties.com
-
izuki-shoes.store
-
lithoptek.biz
-
hhty226.com
-
lineofcredit.solutions
-
deanbenedict.site
-
kaixinkd.com
-
feuerbachporsche.com
-
conhcs.com
-
gaslessdrive.com
-
scaladue.com
-
mskellyscafe.com
-
diamantenfieber.com
-
dakshcomputeraligarh.com
-
ocmanair.com
-
naucg9z.com
-
geldrettung.tips
-
simpledetails.club
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
- Xloader Payload 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe /Processid:{85932C54-3425-4845-AA52-5C110B723941}2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
DB1
DB1
memory/2212-130-0x0000000000CA0000-0x0000000000D90000-memory.dmp
memory/2832-136-0x0000000008790000-0x00000000088E0000-memory.dmp
memory/2832-143-0x0000000008A60000-0x0000000008B83000-memory.dmp
memory/2832-142-0x0000000008A60000-0x0000000008B83000-memory.dmp
memory/4112-139-0x0000000001D00000-0x000000000204A000-memory.dmp
memory/4112-140-0x0000000001290000-0x00000000012BB000-memory.dmp
memory/4112-141-0x0000000001C00000-0x0000000001C90000-memory.dmp
memory/4112-138-0x0000000000EC0000-0x0000000000ECE000-memory.dmp
memory/5096-135-0x0000000001720000-0x0000000001731000-memory.dmp
memory/5096-134-0x0000000001760000-0x0000000001AAA000-memory.dmp
memory/5096-132-0x0000000000400000-0x000000000042B000-memory.dmp