Overview

overview

10

Static

static

PO650.exe

windows7_x64

10

PO650.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    26-08-2021 12:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PO650.exe

  • Size

    260KB

  • MD5

    0f9ed47f1ffe3b1cd242b7872f4ce341

  • SHA1

    37c2b669d727b1aec796644c1f4f884f0ad86944

  • SHA256

    d7abd3634174ad687ef4153f268667361c7177b73871c7dbd296659d918e0d36

  • SHA512

    b739a86c7ba735fe40e7630603519d2383b7615ab5c96780138455496da804e19a3d8b3228afb98403b84cdf9b769b064af899f173dd044bd313b1e32d4a18bf

Score
10/10
xloaderc28hloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

c28h

C2

http://www.yourweddingscent.online/c28h/

Decoy

xn--osegredodameditao-nqb9e.com

blakepleasant.com

midnightindulgence.com

lungx.com

goldenretrieversmn.com

thecapshooter.com

luxuryledlighting.com

coachlind.com

jewelryart-byirene.com

legacyvending.net

staffjet.info

geogest.com

okmulgeedream.center

mexicoifbbproleague.net

tomrings.com

kidsomia.com

learnwithalinguist.com

getboardsuited.com

aiyuc.com

wowmanship.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader Payload 1 IoCs
    rat
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Users\Admin\AppData\Local\Temp\PO650.exe
      "C:\Users\Admin\AppData\Local\Temp\PO650.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3944
      • C:\Users\Admin\AppData\Local\Temp\PO650.exe
        "C:\Users\Admin\AppData\Local\Temp\PO650.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3064
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3800
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\PO650.exe"
        3⤵
          PID:3776

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3044-118-0x0000000003190000-0x0000000003245000-memory.dmp
      Filesize

      724KB

      Download
    • memory/3044-125-0x0000000006EF0000-0x0000000007043000-memory.dmp
      Filesize

      1.3MB

      Download
    • memory/3064-114-0x00000000001ED0D0-mapping.dmp
      Download
    • memory/3064-117-0x0000000000650000-0x0000000000660000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3064-116-0x0000000000B80000-0x0000000000EA0000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/3776-122-0x0000000000000000-mapping.dmp
      Download
    • memory/3800-119-0x0000000000000000-mapping.dmp
      Download
    • memory/3800-121-0x00000000008E0000-0x0000000000909000-memory.dmp
      Filesize

      164KB

      Download
    • memory/3800-120-0x0000000000ED0000-0x000000000130F000-memory.dmp
      Filesize

      4.2MB

      Download
    • memory/3800-123-0x0000000004F10000-0x0000000005230000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/3800-124-0x0000000000D30000-0x0000000000E66000-memory.dmp
      Filesize

      1.2MB

      Download
    • memory/3944-115-0x00000000003E0000-0x00000000003E2000-memory.dmp
      Filesize

      8KB

      Download