Analysis

  • max time kernel
    118s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29/01/2023, 20:28

General

  • Target

    b668feb6432eb6a52d23ee84b25b68244d388bd08e749ba45820dc6a3100153d.exe

  • Size

    756KB

  • MD5

    7c59504b9dfb4ff80ed8530c5bce9ed7

  • SHA1

    04aa7316158ef192b45b2501d4d09a73da05474c

  • SHA256

    b668feb6432eb6a52d23ee84b25b68244d388bd08e749ba45820dc6a3100153d

  • SHA512

    b0f50962d31a3ffa1f9d259b5ae0f4d5bca9f1be76afcf76f503266ff5ccffafed00789b43fce758dc88ecc94fa636eab3bd8204a98eb4b37f3268c3b9acba4b

  • SSDEEP

    12288:9bodd+JGv9M6HLzLOKqyL4y2lHmKjgnXeZQcXMwxm:9Edd+Q/LRL4fmKkOZc

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ur06

Decoy

philippebrooksdesign.com

cmoorestudio.com

profille-sarina23tammara.club

dqulxe.com

uiffinger.com

nolarapper.com

maconanimalexterminator.com

bisovka.com

loveisloveent.com

datication.com

spxo66.com

drhelpnow.com

ladybug-cle.com

macocome.com

thepoppysocks.com

eldritchparadox.com

mercadolibre.company

ismartfarm.com

kansascarlot.com

kevinld.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b668feb6432eb6a52d23ee84b25b68244d388bd08e749ba45820dc6a3100153d.exe
    "C:\Users\Admin\AppData\Local\Temp\b668feb6432eb6a52d23ee84b25b68244d388bd08e749ba45820dc6a3100153d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Users\Admin\AppData\Local\Temp\b668feb6432eb6a52d23ee84b25b68244d388bd08e749ba45820dc6a3100153d.exe
      "C:\Users\Admin\AppData\Local\Temp\b668feb6432eb6a52d23ee84b25b68244d388bd08e749ba45820dc6a3100153d.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1280

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1280-57-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/1280-58-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/1280-60-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/1280-63-0x0000000000CA0000-0x0000000000FA3000-memory.dmp

          Filesize

          3.0MB

        • memory/1736-54-0x0000000076411000-0x0000000076413000-memory.dmp

          Filesize

          8KB

        • memory/1736-55-0x0000000075010000-0x00000000755BB000-memory.dmp

          Filesize

          5.7MB

        • memory/1736-56-0x0000000075010000-0x00000000755BB000-memory.dmp

          Filesize

          5.7MB

        • memory/1736-62-0x0000000075010000-0x00000000755BB000-memory.dmp

          Filesize

          5.7MB