Analysis
- max time kernel
142s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
09/07/2022, 06:45
General
- Target cff53c52ac9b9acbc887af1ee5407ea1.exe
- Size 2.0MB
- Sample220709-hh292afbc2
- SHA256 1fb52fd8e565ad6737e96ed8256dcfde69bb7ad7b0d81f15317dc25e2dbfc8c7
Score
10/10
Malware Config
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Downloads MZ/PE file
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cff53c52ac9b9acbc887af1ee5407ea1.exe"C:\Users\Admin\AppData\Local\Temp\cff53c52ac9b9acbc887af1ee5407ea1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cff53c52ac9b9acbc887af1ee5407ea1.exe"C:\Users\Admin\AppData\Local\Temp\cff53c52ac9b9acbc887af1ee5407ea1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3564-135-0x0000000000400000-0x000000000042C000-memory.dmp
memory/3564-136-0x0000000001920000-0x0000000001C6A000-memory.dmp
memory/4800-130-0x0000000000C10000-0x0000000000E12000-memory.dmp
memory/4800-131-0x0000000005C90000-0x0000000006234000-memory.dmp
memory/4800-132-0x00000000057D0000-0x0000000005862000-memory.dmp
memory/4800-133-0x0000000006D50000-0x0000000006DEC000-memory.dmp