Analysis

  • max time kernel
    97s
  • max time network
    96s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    20/01/2023, 18:13

General

  • Target

    0.exe

  • Size

    163KB

  • MD5

    a4a9a8d2a7bfdcc21c51a2b2015e6de9

  • SHA1

    5ce069dd1c3bc14adbf6629d30350999f42dd6ab

  • SHA256

    223430a82147cb3fdb9c50c0f133c766c42a24ac655406dd908d198a8334dcda

  • SHA512

    86ebdabf102aafb0a4ca5be2446bc6a533e595856f47ff50ac2fe7f71d045576cd684c7a42870bae4f8c65f2f8262fa828058bab51c94f6b8cc7ad92153266aa

  • SSDEEP

    3072:38JCSpCjqSQeAdXZGMy0evnZqQso21HZWgO9b75Gz63WPA0rA:3tC0gIMHSZqQso2qgO9btG+3W40

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

2bun

Decoy

istanbulescort1.xyz

sh1rt.online

digitalmarmot.com

worldscoolesthifi.com

zorgportaalmdn.store

bswys.com

las3curiosas.com

ucokisal.com

xn--j1ad.net

myoveragerecovery.com

eltool.net

shungiteglobal.com

telenor-no.com

xulonrobotics.com

soyredy.com

1forall.info

patsyzeitlin.com

hellocs.xyz

hasundue.net

dein-urkundenrahmen.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 2 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Users\Admin\AppData\Local\Temp\0.exe
      "C:\Users\Admin\AppData\Local\Temp\0.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:1708
    • C:\Windows\SysWOW64\mstsc.exe
      "C:\Windows\SysWOW64\mstsc.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1772
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\0.exe"
        3⤵
        • Deletes itself
        PID:948

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1228-64-0x0000000004CF0000-0x0000000004E0E000-memory.dmp

          Filesize

          1.1MB

        • memory/1228-56-0x0000000004BC0000-0x0000000004CE9000-memory.dmp

          Filesize

          1.2MB

        • memory/1228-66-0x0000000004CF0000-0x0000000004E0E000-memory.dmp

          Filesize

          1.1MB

        • memory/1708-55-0x0000000000280000-0x0000000000291000-memory.dmp

          Filesize

          68KB

        • memory/1708-54-0x0000000000840000-0x0000000000B43000-memory.dmp

          Filesize

          3.0MB

        • memory/1772-58-0x0000000075D51000-0x0000000075D53000-memory.dmp

          Filesize

          8KB

        • memory/1772-60-0x0000000000EF0000-0x0000000000FF4000-memory.dmp

          Filesize

          1.0MB

        • memory/1772-62-0x0000000000B90000-0x0000000000E93000-memory.dmp

          Filesize

          3.0MB

        • memory/1772-61-0x00000000000C0000-0x00000000000E9000-memory.dmp

          Filesize

          164KB

        • memory/1772-63-0x0000000000990000-0x0000000000A20000-memory.dmp

          Filesize

          576KB

        • memory/1772-65-0x00000000000C0000-0x00000000000E9000-memory.dmp

          Filesize

          164KB