Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 18:41

General

  • Target

    Order.exe

  • Size

    1019KB

  • MD5

    8035a8a6435078dafbc920a1ff224d57

  • SHA1

    6596b759833a7580758634e75a878c387b21ff98

  • SHA256

    8ff564a57fcca6daaa6319451c7ccb61537b02b513b8b262a5f76348b70d0287

  • SHA512

    352f74524a9095f42999b307054c5a12fa372359e5d46b406f6718b4106506696ef07d8fd6fcba5443c89ae96bdb02a2c0df689f470088e5d3d79fb1bf8673a5

  • SSDEEP

    24576:C8PGQ+EcKrvDBUgSniJNZSp9lcZUYuAl4KaGiRusf:62KgSiJNoTGuY6LGiRu

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

uqf5

Decoy

suiddock.com

sweetgyalshop.com

puterigarden.com

orangestoreusa.com

prostirkarpat.com

ajierfoods.com

mindlablearning.com

factiive.net

beautifulbrokenhearts.com

direcionalreservapraca.com

tvhoki.com

themoderncoachinstitute.com

classactionwalgreens.com

haloog.com

sachinkaushik.com

daleearnhardtjrchevyvip.com

disconight.net

ocyslibes.icu

encounterfy.com

infamoudpapertrail.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 4 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Users\Admin\AppData\Local\Temp\Order.exe
      "C:\Users\Admin\AppData\Local\Temp\Order.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2208
      • C:\Users\Admin\AppData\Local\Temp\Order.exe
        "C:\Users\Admin\AppData\Local\Temp\Order.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:768
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2556
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Order.exe"
        3⤵
        • Deletes itself
        PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/768-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/768-18-0x00000000001E0000-0x00000000001F0000-memory.dmp

    Filesize

    64KB

  • memory/768-16-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/768-14-0x0000000000D10000-0x0000000001013000-memory.dmp

    Filesize

    3.0MB

  • memory/768-12-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/768-8-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/768-9-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1208-28-0x00000000062A0000-0x0000000006437000-memory.dmp

    Filesize

    1.6MB

  • memory/1208-19-0x00000000062A0000-0x0000000006437000-memory.dmp

    Filesize

    1.6MB

  • memory/1208-17-0x0000000002750000-0x0000000002850000-memory.dmp

    Filesize

    1024KB

  • memory/2208-13-0x0000000074C50000-0x000000007533E000-memory.dmp

    Filesize

    6.9MB

  • memory/2208-2-0x0000000000510000-0x0000000000550000-memory.dmp

    Filesize

    256KB

  • memory/2208-1-0x0000000074C50000-0x000000007533E000-memory.dmp

    Filesize

    6.9MB

  • memory/2208-6-0x00000000058B0000-0x0000000005956000-memory.dmp

    Filesize

    664KB

  • memory/2208-5-0x0000000000510000-0x0000000000550000-memory.dmp

    Filesize

    256KB

  • memory/2208-4-0x0000000074C50000-0x000000007533E000-memory.dmp

    Filesize

    6.9MB

  • memory/2208-3-0x0000000000550000-0x0000000000572000-memory.dmp

    Filesize

    136KB

  • memory/2208-7-0x0000000002430000-0x0000000002490000-memory.dmp

    Filesize

    384KB

  • memory/2208-0-0x0000000000C00000-0x0000000000D06000-memory.dmp

    Filesize

    1.0MB

  • memory/2556-21-0x0000000000AF0000-0x0000000000AFD000-memory.dmp

    Filesize

    52KB

  • memory/2556-22-0x0000000000080000-0x00000000000A9000-memory.dmp

    Filesize

    164KB

  • memory/2556-23-0x0000000002090000-0x0000000002393000-memory.dmp

    Filesize

    3.0MB

  • memory/2556-24-0x0000000000080000-0x00000000000A9000-memory.dmp

    Filesize

    164KB

  • memory/2556-26-0x0000000001F00000-0x0000000001F8F000-memory.dmp

    Filesize

    572KB

  • memory/2556-20-0x0000000000AF0000-0x0000000000AFD000-memory.dmp

    Filesize

    52KB