Analysis

  • max time kernel
    133s
  • max time network
    133s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    07-01-2022 05:03

General

  • Target

    15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe

  • Size

    905KB

  • MD5

    548d5acd91befcf89ccc80c9d8256002

  • SHA1

    776f4950f8109003c1d88e53d7921d27280a3ae7

  • SHA256

    15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f

  • SHA512

    66d54b8c882ffd9c47e941fcaa35e95c0b1f31281b7490b444b7bc65ead3377d2d4d7f82b53201dedd03771ac38f498760898005b9a5287b4e9997a152ab01a6

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe
    "C:\Users\Admin\AppData\Local\Temp\15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Users\Admin\AppData\Local\Temp\15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2680-115-0x00000000003D0000-0x00000000004B8000-memory.dmp
    Filesize

    928KB

  • memory/2680-116-0x00000000003D0000-0x00000000004B8000-memory.dmp
    Filesize

    928KB

  • memory/2680-117-0x0000000005120000-0x000000000561E000-memory.dmp
    Filesize

    5.0MB

  • memory/2680-118-0x0000000004D00000-0x0000000004D92000-memory.dmp
    Filesize

    584KB

  • memory/2680-119-0x0000000004E40000-0x0000000004EDC000-memory.dmp
    Filesize

    624KB

  • memory/2680-120-0x0000000004CE0000-0x0000000004CEA000-memory.dmp
    Filesize

    40KB

  • memory/2680-121-0x0000000004C20000-0x000000000511E000-memory.dmp
    Filesize

    5.0MB

  • memory/2680-122-0x0000000005070000-0x000000000507A000-memory.dmp
    Filesize

    40KB

  • memory/2680-123-0x0000000008BC0000-0x0000000008C3E000-memory.dmp
    Filesize

    504KB

  • memory/2680-124-0x00000000050F0000-0x0000000005120000-memory.dmp
    Filesize

    192KB

  • memory/3472-125-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/3472-126-0x000000000041D400-mapping.dmp
  • memory/3472-127-0x0000000001330000-0x0000000001650000-memory.dmp
    Filesize

    3.1MB