Analysis

  • max time kernel
    56s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    30-07-2021 15:25

General

  • Target

    2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe

  • Size

    887KB

  • MD5

    040cca91f06819461187ad57faa81f30

  • SHA1

    51b4261aa8c7a475ca9223d4dfddc19a2720096f

  • SHA256

    2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e

  • SHA512

    b95e41af609572c7e1de13f03abc9779b00cbc7fc4587345ad1a6259baec08a82e11d8e66e02f11049946dcef6620dcc50d9d9fa120e476eb571698718e4bc80

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.ker-huella.com/synv/

Decoy

hareemshareem.com

aromaticus.club

sakabay.com

ebtedaieeduone.com

goodyertirerebate.com

mehmeterdas.com

everestjsc.com

eqtclub.com

ahlcide.ovh

snifu.com

grinabrasive.info

ijustwannablog.com

eng-in-use.com

mo-ip.group

beautynblackbody.com

presto-eng.info

jarah24.com

marigoldbrewery.com

onpointcomprasbrasil.com

cdrh-consultores.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe
    "C:\Users\Admin\AppData\Local\Temp\2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Users\Admin\AppData\Local\Temp\2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe
      "C:\Users\Admin\AppData\Local\Temp\2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/584-67-0x000000000041D020-mapping.dmp

  • memory/584-66-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/584-68-0x0000000000B60000-0x0000000000E63000-memory.dmp

    Filesize

    3.0MB

  • memory/1860-60-0x0000000000A70000-0x0000000000A71000-memory.dmp

    Filesize

    4KB

  • memory/1860-62-0x0000000004C80000-0x0000000004C81000-memory.dmp

    Filesize

    4KB

  • memory/1860-63-0x0000000000970000-0x000000000098B000-memory.dmp

    Filesize

    108KB

  • memory/1860-64-0x0000000007F80000-0x0000000007FF3000-memory.dmp

    Filesize

    460KB

  • memory/1860-65-0x0000000004BE0000-0x0000000004C0E000-memory.dmp

    Filesize

    184KB