Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 18:39

General

  • Target

    0c90a502cf1d5e66b289b82a22fc1693.exe

  • Size

    1.3MB

  • MD5

    0c90a502cf1d5e66b289b82a22fc1693

  • SHA1

    b7309e98f9d8b58442a77e1619e4524efd7f6a35

  • SHA256

    12d89c6e8e3ef2ec6ae4fda7dce291a2418a51daa9eba44a583ced847c9e4e42

  • SHA512

    fdb013cb09ca14093e5a2f177f91ed1349d47f4c17f7f610818fcf583c00ac518ed55eb655ed460b157024c150b23cdc8406d3795253a5ec7096adc339a2b6b3

  • SSDEEP

    24576:RZKjksXks2y8j19UAWU6rXVoHHsxZmJYis4xBZMN6Z7nsG/d60wZ:RZKaPUjU6rXVosx8J24xgN6Z7n8

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

uecu

Decoy

ishtarhotel.com

woodstrends.icu

jalenowens.com

manno.expert

ssg1asia.com

telepathylaw.com

quickoprintnv.com

abrosnm3.com

lumberjackcatering.com

beachujamaica.com

thomasjeffersonbyrd.com

starryfinds.com

shelavish2.com

royalglamempirellc.com

deixandomeuemprego.com

alexgoestech.xyz

opticamn.com

fermanchevybrandon.com

milbodegas.info

adunarsrl.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • CustAttr .NET packer 1 IoCs

    Detects CustAttr .NET packer in memory.

  • Xloader payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3380
    • C:\Users\Admin\AppData\Local\Temp\0c90a502cf1d5e66b289b82a22fc1693.exe
      "C:\Users\Admin\AppData\Local\Temp\0c90a502cf1d5e66b289b82a22fc1693.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4476
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1320
    • C:\Windows\SysWOW64\NETSTAT.EXE
      "C:\Windows\SysWOW64\NETSTAT.EXE"
      2⤵
      • Suspicious use of SetThreadContext
      • Gathers network information
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5112
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:5048

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1320-12-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/1320-18-0x0000000001330000-0x0000000001340000-memory.dmp

      Filesize

      64KB

    • memory/1320-17-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/1320-15-0x0000000001870000-0x0000000001BBA000-memory.dmp

      Filesize

      3.3MB

    • memory/3380-34-0x0000000008670000-0x00000000087CD000-memory.dmp

      Filesize

      1.4MB

    • memory/3380-31-0x0000000008670000-0x00000000087CD000-memory.dmp

      Filesize

      1.4MB

    • memory/3380-30-0x0000000008670000-0x00000000087CD000-memory.dmp

      Filesize

      1.4MB

    • memory/3380-26-0x00000000080C0000-0x0000000008226000-memory.dmp

      Filesize

      1.4MB

    • memory/3380-19-0x00000000080C0000-0x0000000008226000-memory.dmp

      Filesize

      1.4MB

    • memory/4476-7-0x00000000059E0000-0x00000000059F2000-memory.dmp

      Filesize

      72KB

    • memory/4476-4-0x0000000005AA0000-0x0000000005AB0000-memory.dmp

      Filesize

      64KB

    • memory/4476-11-0x00000000052B0000-0x00000000052DE000-memory.dmp

      Filesize

      184KB

    • memory/4476-9-0x0000000005AA0000-0x0000000005AB0000-memory.dmp

      Filesize

      64KB

    • memory/4476-14-0x00000000749C0000-0x0000000075170000-memory.dmp

      Filesize

      7.7MB

    • memory/4476-8-0x00000000749C0000-0x0000000075170000-memory.dmp

      Filesize

      7.7MB

    • memory/4476-0-0x00000000749C0000-0x0000000075170000-memory.dmp

      Filesize

      7.7MB

    • memory/4476-6-0x0000000005BA0000-0x0000000005C3C000-memory.dmp

      Filesize

      624KB

    • memory/4476-5-0x00000000058D0000-0x00000000058DA000-memory.dmp

      Filesize

      40KB

    • memory/4476-10-0x0000000006930000-0x00000000069CE000-memory.dmp

      Filesize

      632KB

    • memory/4476-1-0x0000000000D80000-0x0000000000ECC000-memory.dmp

      Filesize

      1.3MB

    • memory/4476-2-0x0000000005E40000-0x00000000063E4000-memory.dmp

      Filesize

      5.6MB

    • memory/4476-3-0x0000000005930000-0x00000000059C2000-memory.dmp

      Filesize

      584KB

    • memory/5112-20-0x0000000000020000-0x000000000002B000-memory.dmp

      Filesize

      44KB

    • memory/5112-25-0x0000000000440000-0x0000000000468000-memory.dmp

      Filesize

      160KB

    • memory/5112-28-0x0000000000A20000-0x0000000000AAF000-memory.dmp

      Filesize

      572KB

    • memory/5112-23-0x0000000000CF0000-0x000000000103A000-memory.dmp

      Filesize

      3.3MB

    • memory/5112-22-0x0000000000440000-0x0000000000468000-memory.dmp

      Filesize

      160KB

    • memory/5112-21-0x0000000000020000-0x000000000002B000-memory.dmp

      Filesize

      44KB