Analysis

  • max time kernel
    56s
  • max time network
    118s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    30-07-2021 15:25

General

  • Target

    2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe

  • Size

    887KB

  • MD5

    040cca91f06819461187ad57faa81f30

  • SHA1

    51b4261aa8c7a475ca9223d4dfddc19a2720096f

  • SHA256

    2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e

  • SHA512

    b95e41af609572c7e1de13f03abc9779b00cbc7fc4587345ad1a6259baec08a82e11d8e66e02f11049946dcef6620dcc50d9d9fa120e476eb571698718e4bc80

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.ker-huella.com/synv/

Decoy

hareemshareem.com

aromaticus.club

sakabay.com

ebtedaieeduone.com

goodyertirerebate.com

mehmeterdas.com

everestjsc.com

eqtclub.com

ahlcide.ovh

snifu.com

grinabrasive.info

ijustwannablog.com

eng-in-use.com

mo-ip.group

beautynblackbody.com

presto-eng.info

jarah24.com

marigoldbrewery.com

onpointcomprasbrasil.com

cdrh-consultores.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe
    "C:\Users\Admin\AppData\Local\Temp\2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Users\Admin\AppData\Local\Temp\2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe
      "C:\Users\Admin\AppData\Local\Temp\2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe"
      2⤵
        PID:3300
      • C:\Users\Admin\AppData\Local\Temp\2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe
        "C:\Users\Admin\AppData\Local\Temp\2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3024

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2896-114-0x0000000000B50000-0x0000000000B51000-memory.dmp

      Filesize

      4KB

    • memory/2896-116-0x0000000005940000-0x0000000005941000-memory.dmp

      Filesize

      4KB

    • memory/2896-117-0x00000000054E0000-0x00000000054E1000-memory.dmp

      Filesize

      4KB

    • memory/2896-118-0x0000000005470000-0x0000000005471000-memory.dmp

      Filesize

      4KB

    • memory/2896-119-0x00000000056F0000-0x00000000056F1000-memory.dmp

      Filesize

      4KB

    • memory/2896-120-0x0000000005440000-0x000000000593E000-memory.dmp

      Filesize

      5.0MB

    • memory/2896-121-0x0000000006F40000-0x0000000006F5B000-memory.dmp

      Filesize

      108KB

    • memory/2896-122-0x0000000008B60000-0x0000000008BD3000-memory.dmp

      Filesize

      460KB

    • memory/2896-123-0x0000000008BF0000-0x0000000008C1E000-memory.dmp

      Filesize

      184KB

    • memory/3024-124-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/3024-125-0x000000000041D020-mapping.dmp

    • memory/3024-126-0x0000000001650000-0x0000000001970000-memory.dmp

      Filesize

      3.1MB