Analysis

  • max time kernel
    93s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2023, 18:13

General

  • Target

    0.exe

  • Size

    163KB

  • MD5

    a4a9a8d2a7bfdcc21c51a2b2015e6de9

  • SHA1

    5ce069dd1c3bc14adbf6629d30350999f42dd6ab

  • SHA256

    223430a82147cb3fdb9c50c0f133c766c42a24ac655406dd908d198a8334dcda

  • SHA512

    86ebdabf102aafb0a4ca5be2446bc6a533e595856f47ff50ac2fe7f71d045576cd684c7a42870bae4f8c65f2f8262fa828058bab51c94f6b8cc7ad92153266aa

  • SSDEEP

    3072:38JCSpCjqSQeAdXZGMy0evnZqQso21HZWgO9b75Gz63WPA0rA:3tC0gIMHSZqQso2qgO9btG+3W40

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

2bun

Decoy

istanbulescort1.xyz

sh1rt.online

digitalmarmot.com

worldscoolesthifi.com

zorgportaalmdn.store

bswys.com

las3curiosas.com

ucokisal.com

xn--j1ad.net

myoveragerecovery.com

eltool.net

shungiteglobal.com

telenor-no.com

xulonrobotics.com

soyredy.com

1forall.info

patsyzeitlin.com

hellocs.xyz

hasundue.net

dein-urkundenrahmen.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Users\Admin\AppData\Local\Temp\0.exe
      "C:\Users\Admin\AppData\Local\Temp\0.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:5092
    • C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\SysWOW64\autochk.exe"
      2⤵
        PID:4380
      • C:\Windows\SysWOW64\autochk.exe
        "C:\Windows\SysWOW64\autochk.exe"
        2⤵
          PID:3828
        • C:\Windows\SysWOW64\autochk.exe
          "C:\Windows\SysWOW64\autochk.exe"
          2⤵
            PID:1180
          • C:\Windows\SysWOW64\autochk.exe
            "C:\Windows\SysWOW64\autochk.exe"
            2⤵
              PID:3696
            • C:\Windows\SysWOW64\autochk.exe
              "C:\Windows\SysWOW64\autochk.exe"
              2⤵
                PID:3680
              • C:\Windows\SysWOW64\autochk.exe
                "C:\Windows\SysWOW64\autochk.exe"
                2⤵
                  PID:3720
                • C:\Windows\SysWOW64\autochk.exe
                  "C:\Windows\SysWOW64\autochk.exe"
                  2⤵
                    PID:3436
                  • C:\Windows\SysWOW64\autochk.exe
                    "C:\Windows\SysWOW64\autochk.exe"
                    2⤵
                      PID:5000
                    • C:\Windows\SysWOW64\autochk.exe
                      "C:\Windows\SysWOW64\autochk.exe"
                      2⤵
                        PID:4704
                      • C:\Windows\SysWOW64\autochk.exe
                        "C:\Windows\SysWOW64\autochk.exe"
                        2⤵
                          PID:3708
                        • C:\Windows\SysWOW64\autochk.exe
                          "C:\Windows\SysWOW64\autochk.exe"
                          2⤵
                            PID:2472
                          • C:\Windows\SysWOW64\autoconv.exe
                            "C:\Windows\SysWOW64\autoconv.exe"
                            2⤵
                              PID:400
                            • C:\Windows\SysWOW64\autoconv.exe
                              "C:\Windows\SysWOW64\autoconv.exe"
                              2⤵
                                PID:4700
                              • C:\Windows\SysWOW64\autoconv.exe
                                "C:\Windows\SysWOW64\autoconv.exe"
                                2⤵
                                  PID:4736
                                • C:\Windows\SysWOW64\autoconv.exe
                                  "C:\Windows\SysWOW64\autoconv.exe"
                                  2⤵
                                    PID:4816
                                  • C:\Windows\SysWOW64\autoconv.exe
                                    "C:\Windows\SysWOW64\autoconv.exe"
                                    2⤵
                                      PID:4292
                                    • C:\Windows\SysWOW64\autoconv.exe
                                      "C:\Windows\SysWOW64\autoconv.exe"
                                      2⤵
                                        PID:4448
                                      • C:\Windows\SysWOW64\autoconv.exe
                                        "C:\Windows\SysWOW64\autoconv.exe"
                                        2⤵
                                          PID:3204
                                        • C:\Windows\SysWOW64\autoconv.exe
                                          "C:\Windows\SysWOW64\autoconv.exe"
                                          2⤵
                                            PID:3864
                                          • C:\Windows\SysWOW64\autoconv.exe
                                            "C:\Windows\SysWOW64\autoconv.exe"
                                            2⤵
                                              PID:4444
                                            • C:\Windows\SysWOW64\autoconv.exe
                                              "C:\Windows\SysWOW64\autoconv.exe"
                                              2⤵
                                                PID:3024
                                              • C:\Windows\SysWOW64\autoconv.exe
                                                "C:\Windows\SysWOW64\autoconv.exe"
                                                2⤵
                                                  PID:5004
                                                • C:\Windows\SysWOW64\WWAHost.exe
                                                  "C:\Windows\SysWOW64\WWAHost.exe"
                                                  2⤵
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious behavior: MapViewOfSection
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3300
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    /c del "C:\Users\Admin\AppData\Local\Temp\0.exe"
                                                    3⤵
                                                      PID:1144

                                                Network

                                                      MITRE ATT&CK Matrix

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • memory/2492-134-0x00000000033C0000-0x0000000003500000-memory.dmp

                                                        Filesize

                                                        1.2MB

                                                      • memory/2492-141-0x0000000003500000-0x00000000035F7000-memory.dmp

                                                        Filesize

                                                        988KB

                                                      • memory/2492-143-0x0000000003500000-0x00000000035F7000-memory.dmp

                                                        Filesize

                                                        988KB

                                                      • memory/3300-138-0x0000000000140000-0x0000000000169000-memory.dmp

                                                        Filesize

                                                        164KB

                                                      • memory/3300-137-0x00000000009B0000-0x0000000000A8C000-memory.dmp

                                                        Filesize

                                                        880KB

                                                      • memory/3300-139-0x00000000011F0000-0x000000000153A000-memory.dmp

                                                        Filesize

                                                        3.3MB

                                                      • memory/3300-140-0x0000000000F20000-0x0000000000FB0000-memory.dmp

                                                        Filesize

                                                        576KB

                                                      • memory/3300-142-0x0000000000140000-0x0000000000169000-memory.dmp

                                                        Filesize

                                                        164KB

                                                      • memory/5092-132-0x0000000000B40000-0x0000000000E8A000-memory.dmp

                                                        Filesize

                                                        3.3MB

                                                      • memory/5092-133-0x00000000005E0000-0x00000000005F1000-memory.dmp

                                                        Filesize

                                                        68KB