Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
21/11/2024, 20:02
General
- Target RFQ101#2021.exe
- Size 509KB
- Sample241121-ysff1swmcv
- SHA256 998d8ff737921cf6d3bbbc7294125f872e40f7580e3ea9c81188d794786d8749
Malware Config
Extracted
-
xloader
-
2.5
-
c0vz
-
barmorelosmx.com
-
wearablegraphene.com
-
lopsrental.lease
-
259771.com
-
wizer.digital
-
at7eleven.ink
-
szshuojing.com
-
coffsmobilebarber.com
-
swift-goods.com
-
hashstox.com
-
my-safqati.com
-
herba-soul.com
-
tethysbooks.com
-
learnwebrtc.com
-
tzwco.com
-
buzzingyhvlgr.online
-
aryocoding.com
-
yourdaruma.com
-
choice-recordtoreadtoday.info
-
trand-chicks.art
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader family
- Xloader payload 4 IoCs
- Blocklisted process makes network request 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ101#2021.exe"C:\Users\Admin\AppData\Local\Temp\RFQ101#2021.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ101#2021.exe"C:\Users\Admin\AppData\Local\Temp\RFQ101#2021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ101#2021.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2996-8-0x0000000001580000-0x00000000018CA000-memory.dmp
memory/2996-14-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2996-15-0x00000000010E0000-0x00000000010F1000-memory.dmp
memory/2996-10-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2996-11-0x0000000001080000-0x0000000001091000-memory.dmp
memory/2996-5-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3512-19-0x0000000000490000-0x00000000004A6000-memory.dmp
memory/3512-18-0x0000000000490000-0x00000000004A6000-memory.dmp
memory/3512-20-0x0000000000780000-0x00000000007A9000-memory.dmp
memory/3568-12-0x00000000084B0000-0x00000000085F6000-memory.dmp
memory/3568-16-0x0000000007530000-0x0000000007645000-memory.dmp
memory/3568-17-0x00000000084B0000-0x00000000085F6000-memory.dmp
memory/3568-21-0x0000000007530000-0x0000000007645000-memory.dmp
memory/3568-24-0x0000000008A70000-0x0000000008BF4000-memory.dmp
memory/3568-26-0x0000000008A70000-0x0000000008BF4000-memory.dmp
memory/4588-7-0x0000000074930000-0x0000000074EE1000-memory.dmp
memory/4588-2-0x0000000074930000-0x0000000074EE1000-memory.dmp
memory/4588-1-0x0000000074930000-0x0000000074EE1000-memory.dmp
memory/4588-0-0x0000000074932000-0x0000000074933000-memory.dmp
memory/4588-3-0x0000000074932000-0x0000000074933000-memory.dmp
memory/4588-4-0x0000000074930000-0x0000000074EE1000-memory.dmp