Analysis
- max time kernel
45s - max time network
49s - platform
windows7_x64 - resource
win7-20220414-en - submitted
28/06/2022, 11:14
General
- Target 85be6547409011c0804230f2f09f7ca3.exe
- Size 641KB
- Sample220628-nbzhfshaar
- SHA256 1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd
Malware Config
Extracted
-
xloader
-
2.8
-
nn40
-
LYAg0yANOGEAGeaFOrA/
-
MQWuERZplP+VZy/uszI=
-
CF0oDN0JimIaGy/uszI=
-
ltJnyC+ReohYaiTvj1qbEA==
-
B9OkgdctVKBAFjSUaw==
-
sbDVwSZVVqVB11/deow8GA==
-
v1gHDe0pzno=
-
i+/0n2vHUfGPR98k77tukZ90MQ==
-
SUtCnbS96Qm21g==
-
8X9qzyt1dpAo31jXrXfKb49fBPY=
-
5KlPxqHzSstuFjSUaw==
-
0r/Kesv/zuanroxvNQW0Gm8=
-
FFgS7kfPYAqpdhhgRgnBJHY=
-
LgusAHrkrIoWr0FWIe2o/04UXPw=
-
vBq9Gvxa9wbKbS/uszI=
-
Z+q6HAZNNeqwwQ==
-
wbS4fMb06SjU5Kbseow8GA==
-
1mZEuZvJ/m0L9bof56PkkZ90MQ==
-
JCJIM74lHk/o+tiFOrA/
-
d14FrM8rGEgIzVkT67+3XaEh
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\85be6547409011c0804230f2f09f7ca3.exe"C:\Users\Admin\AppData\Local\Temp\85be6547409011c0804230f2f09f7ca3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\85be6547409011c0804230f2f09f7ca3.exe"C:\Users\Admin\AppData\Local\Temp\85be6547409011c0804230f2f09f7ca3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/844-60-0x0000000000400000-0x000000000042C000-memory.dmp
memory/844-61-0x0000000000400000-0x000000000042C000-memory.dmp
memory/844-63-0x0000000000400000-0x000000000042C000-memory.dmp
memory/844-65-0x0000000000930000-0x0000000000C33000-memory.dmp
memory/1980-54-0x0000000000F10000-0x0000000000FB6000-memory.dmp
memory/1980-55-0x00000000768D1000-0x00000000768D3000-memory.dmp
memory/1980-56-0x0000000000410000-0x000000000042C000-memory.dmp
memory/1980-57-0x0000000000430000-0x000000000043A000-memory.dmp
memory/1980-58-0x0000000005B30000-0x0000000005B9A000-memory.dmp
memory/1980-59-0x0000000000A90000-0x0000000000AC2000-memory.dmp