Analysis

  • max time kernel
    117s
  • max time network
    126s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    13-01-2022 13:34

General

  • Target

    a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe

  • Size

    582KB

  • MD5

    0e99d13aafcc5e8fadc45d8b85336d9b

  • SHA1

    6573c9dd229e50981aa24128ad02a07e99805369

  • SHA256

    a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f

  • SHA512

    d2c22cff7ad0e8ea73b4d6a82f732d5d4f10033598040d545f00711d5a9c10c2d78e5c5aa17c8cacf9434e361f4b947a33c4849e800e2f3df7b73245ecd69d5a

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe
    "C:\Users\Admin\AppData\Local\Temp\a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2448
    • C:\Users\Admin\AppData\Local\Temp\a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe
      "C:\Users\Admin\AppData\Local\Temp\a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe"
      2⤵
        PID:1608
      • C:\Users\Admin\AppData\Local\Temp\a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe
        "C:\Users\Admin\AppData\Local\Temp\a15402c5f869a1c02421742c27dd71c2448bb037d391a6bf130be06b2f976e2f.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3748

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2448-115-0x0000000000690000-0x0000000000728000-memory.dmp
      Filesize

      608KB

    • memory/2448-116-0x0000000000690000-0x0000000000728000-memory.dmp
      Filesize

      608KB

    • memory/2448-117-0x0000000005680000-0x0000000005B7E000-memory.dmp
      Filesize

      5.0MB

    • memory/2448-118-0x00000000050A0000-0x0000000005132000-memory.dmp
      Filesize

      584KB

    • memory/2448-119-0x0000000005000000-0x0000000005092000-memory.dmp
      Filesize

      584KB

    • memory/2448-120-0x0000000005150000-0x000000000515A000-memory.dmp
      Filesize

      40KB

    • memory/2448-121-0x0000000005340000-0x00000000053DC000-memory.dmp
      Filesize

      624KB

    • memory/2448-122-0x0000000005660000-0x000000000566E000-memory.dmp
      Filesize

      56KB

    • memory/2448-123-0x00000000086D0000-0x000000000871B000-memory.dmp
      Filesize

      300KB

    • memory/2448-124-0x0000000008B00000-0x0000000008B5E000-memory.dmp
      Filesize

      376KB

    • memory/3748-125-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/3748-126-0x000000000041D400-mapping.dmp
    • memory/3748-127-0x0000000000F00000-0x0000000001220000-memory.dmp
      Filesize

      3.1MB