Analysis
- max time kernel
154s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
08/07/2022, 15:11
General
- Target b1136341dce035655548d5c78daca86e.exe
- Size 384KB
- Sample220708-skk4mshee4
- SHA256 e4368355994cacf472d053ff31a672820b4a293b7f7cff9eb1347dbe5335c9d7
Malware Config
Extracted
-
xloader
-
2.6
-
mt88
-
syzbf32.xyz
-
pertlines.com
-
vybaveniprocyklostezky.com
-
elianmsalas.tech
-
a-snag-tokei-kaitori.com
-
tuvistaing.com
-
whoyoucall.net
-
l8e9gr.xyz
-
sophrologuemontevrain77.com
-
ciclean.com
-
the-roel.com
-
campgreencove.com
-
foremostbookkeeping.com
-
zamanscorner.com
-
efeturozemniyet.com
-
penelope.team
-
murata.life
-
solfuls.com
-
tradefitinvesting.com
-
skinbid.pro
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b1136341dce035655548d5c78daca86e.exe"C:\Users\Admin\AppData\Local\Temp\b1136341dce035655548d5c78daca86e.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2812-143-0x0000000002960000-0x0000000002CAA000-memory.dmp
memory/2812-146-0x00000000008E0000-0x000000000090B000-memory.dmp
memory/2812-144-0x00000000026B0000-0x0000000002740000-memory.dmp
memory/2812-142-0x00000000008E0000-0x000000000090B000-memory.dmp
memory/2812-141-0x0000000000330000-0x0000000000349000-memory.dmp
memory/3084-147-0x0000000008460000-0x0000000008579000-memory.dmp
memory/3084-145-0x0000000008460000-0x0000000008579000-memory.dmp
memory/3084-137-0x0000000002B10000-0x0000000002CAF000-memory.dmp
memory/4744-130-0x00000000007B0000-0x0000000000812000-memory.dmp
memory/4872-135-0x0000000001040000-0x000000000138A000-memory.dmp
memory/4872-139-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4872-136-0x0000000000B40000-0x0000000000B51000-memory.dmp
memory/4872-133-0x0000000000400000-0x000000000042B000-memory.dmp