Analysis
- max time kernel
134s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
15/06/2022, 20:12
General
- Target c4152100ece7c574e1a8e3af63fb43c1.exe
- Size 624KB
- Sample220615-yytwlabhgr
- SHA256 5bc966e22893f103baa526fdd1392a0350890a4a151670fe608f55f32eaa9c1b
Malware Config
Extracted
-
xloader
-
2.6
-
ip4t
-
710wgm.com
-
ournewhorizon.com
-
hilfe-online.xyz
-
suryaciptanusantara.com
-
hfrdwy.com
-
solutionscollection.com
-
savor.menu
-
fxivcama.com
-
freedom-recruitment.com
-
owldit.com
-
fullbiz.online
-
ztgifts.com
-
zerlastreeservices.com
-
simpleenergyai.com
-
ostheide-immobilien.com
-
mike-piano.com
-
xiheps.com
-
usedcarindonesia-ace.com
-
yuncuiyunying.xyz
-
hopecrtprotour.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4152100ece7c574e1a8e3af63fb43c1.exe"C:\Users\Admin\AppData\Local\Temp\c4152100ece7c574e1a8e3af63fb43c1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c4152100ece7c574e1a8e3af63fb43c1.exe"C:\Users\Admin\AppData\Local\Temp\c4152100ece7c574e1a8e3af63fb43c1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/228-136-0x0000000000400000-0x000000000042B000-memory.dmp
memory/228-137-0x0000000001000000-0x000000000134A000-memory.dmp
memory/2452-130-0x0000000000060000-0x0000000000102000-memory.dmp
memory/2452-131-0x0000000004FB0000-0x0000000005554000-memory.dmp
memory/2452-132-0x0000000004A00000-0x0000000004A92000-memory.dmp
memory/2452-133-0x00000000049C0000-0x00000000049CA000-memory.dmp
memory/2452-134-0x0000000008520000-0x00000000085BC000-memory.dmp