Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
26/09/2024, 09:10
General
- Target MAERSK Shipping Information_Pdf.exe
- Size 570KB
- Sample240926-k5ehlaydnl
- SHA256 201436245bc7a5ccba11660b260ae4361b26b2e4a301491c4f2b319f8eeb9122
Malware Config
Extracted
-
xloader
-
2.3
-
u86g
-
4tnoxrox.com
-
ff130.com
-
grapevinecrisiscare.com
-
system91.com
-
blondedocfabprivacypolicy.com
-
amphorabeverageservices.com
-
cvacity.info
-
cbghemppills.com
-
iowaconcertofhope.com
-
theilerablog.com
-
bg1133.com
-
jenniferkristinphotography.com
-
wnj.xyz
-
khdoctor.com
-
mittelstandsgestaltung.com
-
mimikis.info
-
my-data.pro
-
nativesonlabs.com
-
thelincmagazine.com
-
dsfrederick.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 4 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MAERSK Shipping Information_Pdf.exe"C:\Users\Admin\AppData\Local\Temp\MAERSK Shipping Information_Pdf.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MAERSK Shipping Information_Pdf.exe"C:\Users\Admin\AppData\Local\Temp\MAERSK Shipping Information_Pdf.exe"3⤵
- Suspicious use of SetThreadContext
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\MAERSK Shipping Information_Pdf.exe"3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2456-28-0x00000000004B0000-0x00000000004D9000-memory.dmp
memory/2456-26-0x0000000000410000-0x0000000000429000-memory.dmp
memory/2456-25-0x0000000000410000-0x0000000000429000-memory.dmp
memory/3340-12-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3340-21-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3340-22-0x0000000001170000-0x0000000001180000-memory.dmp
memory/3340-17-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3340-18-0x0000000001120000-0x0000000001130000-memory.dmp
memory/3340-15-0x00000000011D0000-0x000000000151A000-memory.dmp
memory/3436-24-0x0000000008B50000-0x0000000008C92000-memory.dmp
memory/3436-19-0x0000000008B50000-0x0000000008C92000-memory.dmp
memory/3436-33-0x0000000008F80000-0x00000000090C6000-memory.dmp
memory/3436-31-0x0000000008F80000-0x00000000090C6000-memory.dmp
memory/3436-27-0x0000000008DD0000-0x0000000008F76000-memory.dmp
memory/3436-23-0x0000000008DD0000-0x0000000008F76000-memory.dmp
memory/3824-8-0x00000000748AE000-0x00000000748AF000-memory.dmp
memory/3824-6-0x0000000005930000-0x000000000593E000-memory.dmp
memory/3824-7-0x0000000008090000-0x000000000812C000-memory.dmp
memory/3824-10-0x0000000008540000-0x00000000085BC000-memory.dmp
memory/3824-5-0x0000000005850000-0x000000000585A000-memory.dmp
memory/3824-4-0x00000000748A0000-0x0000000075050000-memory.dmp
memory/3824-0-0x00000000748AE000-0x00000000748AF000-memory.dmp
memory/3824-3-0x0000000005690000-0x0000000005722000-memory.dmp
memory/3824-2-0x0000000005D10000-0x00000000062B4000-memory.dmp
memory/3824-14-0x00000000748A0000-0x0000000075050000-memory.dmp
memory/3824-1-0x0000000000C30000-0x0000000000CC4000-memory.dmp
memory/3824-9-0x00000000748A0000-0x0000000075050000-memory.dmp
memory/3824-11-0x0000000008630000-0x0000000008674000-memory.dmp