Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
21/04/2024, 17:15
General
- Target Transfer Swift Copy.exe
- Size 528KB
- Sample240421-vsmcsafg86
- SHA256 e51b63aacca71c639c6f3b12a6b0eede821c54567125b52a21a0a24ec540d04a
Malware Config
Extracted
-
xloader
-
2.3
-
u8aa
-
quantexchanges.com
-
hizliarac.com
-
dropsdementanovohamburgo.com
-
tcinsurancegroup.net
-
byobvendors.com
-
arteasba.com
-
azrealtorsmastermind.com
-
voiceof5aabtv.com
-
zoom-bloopers.com
-
jxsenmei.com
-
interia-poczta.email
-
coolgiftbaskets.net
-
magetu.info
-
weedliberal.com
-
drsergiocastilloangiologo.com
-
starinsiderau.com
-
weightneutralmetflex.com
-
youxiandian.com
-
liberation.media
-
ferrari-news.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Transfer Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\Transfer Swift Copy.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Transfer Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\Transfer Swift Copy.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Transfer Swift Copy.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1004-3-0x0000000000FA0000-0x0000000000FF4000-memory.dmp
memory/1004-1-0x0000000000EB0000-0x0000000000EB2000-memory.dmp
memory/1004-0-0x0000000000FA0000-0x0000000000FF4000-memory.dmp
memory/1932-13-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1932-15-0x00000000021B0000-0x000000000223F000-memory.dmp
memory/1932-12-0x00000000023C0000-0x000000000270A000-memory.dmp
memory/1932-11-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1932-10-0x0000000000600000-0x000000000060C000-memory.dmp
memory/1932-9-0x0000000000600000-0x000000000060C000-memory.dmp
memory/3448-8-0x0000000008840000-0x000000000897D000-memory.dmp
memory/3448-18-0x0000000008B10000-0x0000000008C4C000-memory.dmp
memory/3448-19-0x0000000008B10000-0x0000000008C4C000-memory.dmp
memory/3448-22-0x0000000008B10000-0x0000000008C4C000-memory.dmp
memory/3868-7-0x0000000001460000-0x0000000001470000-memory.dmp
memory/3868-6-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3868-2-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3868-4-0x00000000018F0000-0x0000000001C3A000-memory.dmp