Analysis
-
max time kernel
61s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
30-07-2021 15:25
General
-
Target
6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe
-
Size
629KB
-
MD5
401dd1e7907e4e7f7cc2c5bbb958df9d
-
SHA1
39b943e797c7a932f4a65a7d8f90bea31e0d7c05
-
SHA256
6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b
-
SHA512
27c9aa747bf843cb49a253253f8055cf2d856258294582e5ba1c7b6548b003ee56b37f5eabaaae9578c98784dce8011271e01be97d2dab752855b3244be7e069
Malware Config
Extracted
xloader
2.3
http://www.lazz.life/mm8v/
candobiotec.com
furnikna.com
smartmoto-canada.com
austinsubarusouth.com
seauxfierce.com
ashcomgh.com
salvamentoselcastor.com
lifetioncoin.tech
mypay.money
eczaci-tr.com
fireloxmusic.com
prendafamily.com
chroniclefighter.com
ogopizza.online
qualiacare.com
kamenjoy.com
shinanogroup.com
zaceniadult.info
thehetaira.com
enter-coworking.com
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe"C:\Users\Admin\AppData\Local\Temp\6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe"C:\Users\Admin\AppData\Local\Temp\6707289e11e16158e605882cdd2ce2fc9574428dd0114c6d6246146cb6ba7b1b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
-
Filesize
3.1MB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
108KB
-
Filesize
444KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB