Analysis
-
max time kernel
135s -
max time network
163s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20-09-2021 11:47
General
-
Target
f1540e89eeb7046cd265d37ef63a6d282a1ff8a89875193ae775582e74205594.bin.exe
-
Size
1.3MB
-
MD5
01b0dffa7c000f4d55544eb38f8ab238
-
SHA1
cfa6ae5441f0c41d5d92e0fab0eb90b44e0d621e
-
SHA256
f1540e89eeb7046cd265d37ef63a6d282a1ff8a89875193ae775582e74205594
-
SHA512
d55c5d8e942d5dfe74a4ece63b707fa2a6f5d8551ed268d08eab9258ab9d91371d13a2dd447eb860b71bcbb125d5a1948b61bf40a2b7321dde7d6d2ce83cb526
Malware Config
Extracted
xloader
2.5
c2ue
http://www.heidevelop.xyz/c2ue/
isportdata.com
stellarex.energy
hsucollections.com
menuhaisan.com
joe-tzu.com
lumichargemktg.com
uae.tires
rapidcae.com
softwaresystemsolutions.com
s-galaxy.website
daewon-talks.net
northgamesnetwork.com
catalogue-bouyguestele.com
criativanet.com
theseasonalshift.com
actionfoto.online
openmaildoe.com
trashpenguin.com
ennopure.net
azurermine.com
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1540e89eeb7046cd265d37ef63a6d282a1ff8a89875193ae775582e74205594.bin.exe"C:\Users\Admin\AppData\Local\Temp\f1540e89eeb7046cd265d37ef63a6d282a1ff8a89875193ae775582e74205594.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f1540e89eeb7046cd265d37ef63a6d282a1ff8a89875193ae775582e74205594.bin.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
-
-
Filesize
3.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
68KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
492KB
-
Filesize
172KB