Analysis

  • max time kernel
    116s
  • max time network
    119s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    21-09-2021 14:10

General

  • Target

    f92898079644c77d76a03ad969332f03.exe

  • Size

    579KB

  • MD5

    f92898079644c77d76a03ad969332f03

  • SHA1

    4dfda3116b95639ce0e6afd68a433f12262e2617

  • SHA256

    e911d332af82b2e6fe66b7d2df23b5a9ba0443ea8f83500ae17c6af1f65d401b

  • SHA512

    cc514da892c3bba8b868279d7b1fc06d158662066130cddf67d5b753a7dc20789a31168b7a4a485f49b115f29081d9e396446bbb6325fde7ea7cf3e88f449663

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.4

Campaign

uytf

C2

http://www.fasilitatortoefl.com/uytf/

Decoy

estherestates.online

babyballetwigan.com

ignorantrough.xyz

moominmamalog.com

pasticcerialemmi.com

orangstyle.com

oldwaterfordfarm.com

aiiqiuwnsas.com

youindependents.com

runbank.net

phytolipshine.com

almedmedicalcenter.com

czxzsa.com

yummyblockparty.com

gadgetinfo.info

cloudfolderplayer.com

chowding.com

xn--tarzmbu-ufb.com

danielaasab.com

dreampropertiesluxury.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f92898079644c77d76a03ad969332f03.exe
    "C:\Users\Admin\AppData\Local\Temp\f92898079644c77d76a03ad969332f03.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2284
    • C:\Users\Admin\AppData\Local\Temp\f92898079644c77d76a03ad969332f03.exe
      "C:\Users\Admin\AppData\Local\Temp\f92898079644c77d76a03ad969332f03.exe"
      2⤵
        PID:2768
      • C:\Users\Admin\AppData\Local\Temp\f92898079644c77d76a03ad969332f03.exe
        "C:\Users\Admin\AppData\Local\Temp\f92898079644c77d76a03ad969332f03.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3480

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2284-115-0x0000000000260000-0x0000000000261000-memory.dmp
      Filesize

      4KB

    • memory/2284-117-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
      Filesize

      4KB

    • memory/2284-118-0x0000000004B70000-0x0000000004B71000-memory.dmp
      Filesize

      4KB

    • memory/2284-119-0x0000000004B30000-0x0000000004B31000-memory.dmp
      Filesize

      4KB

    • memory/2284-120-0x0000000004AD0000-0x0000000004FCE000-memory.dmp
      Filesize

      5.0MB

    • memory/2284-121-0x0000000004D70000-0x0000000004D8D000-memory.dmp
      Filesize

      116KB

    • memory/2284-122-0x00000000071F0000-0x00000000071F1000-memory.dmp
      Filesize

      4KB

    • memory/2284-123-0x0000000007320000-0x000000000737C000-memory.dmp
      Filesize

      368KB

    • memory/2284-124-0x0000000007380000-0x00000000073AC000-memory.dmp
      Filesize

      176KB

    • memory/3480-125-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/3480-126-0x000000000041D520-mapping.dmp
    • memory/3480-127-0x00000000016A0000-0x00000000019C0000-memory.dmp
      Filesize

      3.1MB