Analysis

  • max time kernel
    146s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 00:43

General

  • Target

    1dce0fc0bcc3ed4f7af74bdaeef37a5f.exe

  • Size

    1.2MB

  • MD5

    1dce0fc0bcc3ed4f7af74bdaeef37a5f

  • SHA1

    44db74becdf78474e7b4418cd24274b88410c02f

  • SHA256

    e8bb9e81ed75437b45f90b1c65e3100c618090d66d7fa37f5208fedc6972f142

  • SHA512

    55770eaac58703a98bb05f8da7b7357cd09b747de3dbb89f41fae380d6fa50ad5302398c8b8fffa18257b234e5f3e7a7a315bd0470f379720d34fd8b1e317f46

  • SSDEEP

    24576:cxOsBgo0q4wMMBmCmTOUd+L6kLXWGmHUdR6B8w5+lx/2:cIoHMUmCm6Ud+zLXbmHVB8Bx+

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

wten

Decoy

largshomebuyers.com

hqs.xyz

stormvalleysoapco.com

coolsoftware.xyz

creditfitbootcamp.com

mdroc.com

cooperseyewear.com

mrleyos.com

apipacking.com

mtdivas.com

bim3dstudio.com

ngdnwgtsf.club

arknmhsc.com

expowe.icu

surfacesupplierscanada.com

thinbluelion.com

vbetmalaysia.com

christcarriers.com

easternshoreautobody.com

healthyvibrantandbeautiful.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • CustAttr .NET packer 1 IoCs

    Detects CustAttr .NET packer in memory.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1dce0fc0bcc3ed4f7af74bdaeef37a5f.exe
    "C:\Users\Admin\AppData\Local\Temp\1dce0fc0bcc3ed4f7af74bdaeef37a5f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3264
    • C:\Users\Admin\AppData\Local\Temp\1dce0fc0bcc3ed4f7af74bdaeef37a5f.exe
      "C:\Users\Admin\AppData\Local\Temp\1dce0fc0bcc3ed4f7af74bdaeef37a5f.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3264-8-0x00000000062F0000-0x0000000006302000-memory.dmp

    Filesize

    72KB

  • memory/3264-9-0x0000000074D40000-0x00000000754F0000-memory.dmp

    Filesize

    7.7MB

  • memory/3264-2-0x0000000005270000-0x000000000530C000-memory.dmp

    Filesize

    624KB

  • memory/3264-3-0x00000000058C0000-0x0000000005E64000-memory.dmp

    Filesize

    5.6MB

  • memory/3264-4-0x00000000053B0000-0x0000000005442000-memory.dmp

    Filesize

    584KB

  • memory/3264-5-0x0000000005570000-0x0000000005580000-memory.dmp

    Filesize

    64KB

  • memory/3264-1-0x0000000000770000-0x00000000008AC000-memory.dmp

    Filesize

    1.2MB

  • memory/3264-6-0x0000000005340000-0x000000000534A000-memory.dmp

    Filesize

    40KB

  • memory/3264-0-0x0000000074D40000-0x00000000754F0000-memory.dmp

    Filesize

    7.7MB

  • memory/3264-7-0x00000000055E0000-0x0000000005636000-memory.dmp

    Filesize

    344KB

  • memory/3264-10-0x0000000005570000-0x0000000005580000-memory.dmp

    Filesize

    64KB

  • memory/3264-11-0x0000000006DD0000-0x0000000006E4C000-memory.dmp

    Filesize

    496KB

  • memory/3264-12-0x0000000006E50000-0x0000000006E84000-memory.dmp

    Filesize

    208KB

  • memory/3264-15-0x0000000074D40000-0x00000000754F0000-memory.dmp

    Filesize

    7.7MB

  • memory/4408-13-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/4408-16-0x0000000001460000-0x00000000017AA000-memory.dmp

    Filesize

    3.3MB