Analysis

  • max time kernel
    150s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    25-05-2022 14:00

General

  • Target

    INQNEW~0.exe

  • Size

    276KB

  • MD5

    ebb0fecde4a2e88c63c27c82810113b5

  • SHA1

    c5658bec21ea4dfe2d0a66089d2d18bf081c778f

  • SHA256

    df1b0eef4f32a5c2527691175375962957db71bc913d37f6e71150e599b2b31c

  • SHA512

    05960c717d5f30ca5b1424a3a2806c2a7a00b6ec4a3949bdb7db4d7f5fd885119cf18cbb752537ddcb7bc277ecf683d060c40baee3ac6bdb6f76cb5a50598ad8

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

be4o

Decoy

laboratoriobioixcha.com

tictocperushop.online

wild-oceans.com

belaruscountry.com

kicktmall.com

fitcoinweb.tech

mores.one

gogear.one

gxrcksy.com

samrcq.com

impossible-icecream.com

bravesxx.com

bookchainart.com

sleepsolutionsofmboro.com

ocbrazilbusinessclub.com

advisor76.xyz

xitaotech.com

mgsdtytifgf3414.xyz

johnson-brown.net

cr3drt.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\INQNEW~0.exe
    "C:\Users\Admin\AppData\Local\Temp\INQNEW~0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:504
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
        PID:1596
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 184
          3⤵
          • Program crash
          PID:3404
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1596 -ip 1596
      1⤵
        PID:2924

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scripting

      1
      T1064

      Defense Evasion

      Scripting

      1
      T1064

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/504-130-0x0000000000CE0000-0x0000000000D2A000-memory.dmp
        Filesize

        296KB

      • memory/504-131-0x0000000005B80000-0x0000000006124000-memory.dmp
        Filesize

        5.6MB

      • memory/1596-132-0x0000000000000000-mapping.dmp
      • memory/1596-134-0x0000000000500000-0x000000000052B000-memory.dmp
        Filesize

        172KB