Analysis
-
max time kernel
133s -
max time network
136s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
03-05-2021 07:03
General
-
Target
ada8b1320a6f303fbd5c09d3dab2235a.exe
-
Size
734KB
-
MD5
ada8b1320a6f303fbd5c09d3dab2235a
-
SHA1
127abb366bfbc70bdb90d0339333b02261eb2140
-
SHA256
703a9d816bb422e4d2adeee4f7b6df250bf0441004c0939a03e927400420d9b9
-
SHA512
64e7c304b70911735ad1225d9ad080805f5667b63216308906bb8d8a8463c01dfd1dc43c0b62ebca0c3eab2831d8d17889f4205bfece85e4fc0dfaaca5f98f76
Malware Config
Extracted
xloader
2.3
http://www.ejsuniqueclasses.com/f0sg/
deondevemaagua.com
highcolorchem.com
remax-pros-sd.com
smartmotiontrans.com
staltower.com
raiseamerican.com
io-tonix.com
llawenydd.com
minkladieshaircollections.com
ataria.net
roofers-baltimore.com
infinityventura.com
dvdxbase.com
babebrowpen.com
rascontractingllc.com
designingdreamshome.com
groobefunnels.com
americanstatesapparel.com
theketodesserts.com
bend-a-knee.com
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ada8b1320a6f303fbd5c09d3dab2235a.exe"C:\Users\Admin\AppData\Local\Temp\ada8b1320a6f303fbd5c09d3dab2235a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ada8b1320a6f303fbd5c09d3dab2235a.exe"C:\Users\Admin\AppData\Local\Temp\ada8b1320a6f303fbd5c09d3dab2235a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
668KB
-
Filesize
384KB
-
Filesize
164KB
-
-
Filesize
3.1MB