Analysis

  • max time kernel
    142s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 06:48

General

  • Target

    Order.exe

  • Size

    1019KB

  • MD5

    8035a8a6435078dafbc920a1ff224d57

  • SHA1

    6596b759833a7580758634e75a878c387b21ff98

  • SHA256

    8ff564a57fcca6daaa6319451c7ccb61537b02b513b8b262a5f76348b70d0287

  • SHA512

    352f74524a9095f42999b307054c5a12fa372359e5d46b406f6718b4106506696ef07d8fd6fcba5443c89ae96bdb02a2c0df689f470088e5d3d79fb1bf8673a5

  • SSDEEP

    24576:C8PGQ+EcKrvDBUgSniJNZSp9lcZUYuAl4KaGiRusf:62KgSiJNoTGuY6LGiRu

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

uqf5

Decoy

suiddock.com

sweetgyalshop.com

puterigarden.com

orangestoreusa.com

prostirkarpat.com

ajierfoods.com

mindlablearning.com

factiive.net

beautifulbrokenhearts.com

direcionalreservapraca.com

tvhoki.com

themoderncoachinstitute.com

classactionwalgreens.com

haloog.com

sachinkaushik.com

daleearnhardtjrchevyvip.com

disconight.net

ocyslibes.icu

encounterfy.com

infamoudpapertrail.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3512
    • C:\Users\Admin\AppData\Local\Temp\Order.exe
      "C:\Users\Admin\AppData\Local\Temp\Order.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1472
      • C:\Users\Admin\AppData\Local\Temp\Order.exe
        "C:\Users\Admin\AppData\Local\Temp\Order.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2636
    • C:\Windows\SysWOW64\raserver.exe
      "C:\Windows\SysWOW64\raserver.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3652
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Order.exe"
        3⤵
          PID:1840

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1472-15-0x00000000750B0000-0x0000000075860000-memory.dmp

      Filesize

      7.7MB

    • memory/1472-11-0x0000000006F20000-0x0000000006FC6000-memory.dmp

      Filesize

      664KB

    • memory/1472-2-0x0000000005570000-0x000000000560C000-memory.dmp

      Filesize

      624KB

    • memory/1472-3-0x0000000005BC0000-0x0000000006164000-memory.dmp

      Filesize

      5.6MB

    • memory/1472-4-0x0000000005610000-0x00000000056A2000-memory.dmp

      Filesize

      584KB

    • memory/1472-7-0x0000000005850000-0x00000000058A6000-memory.dmp

      Filesize

      344KB

    • memory/1472-6-0x0000000005560000-0x000000000556A000-memory.dmp

      Filesize

      40KB

    • memory/1472-5-0x0000000005500000-0x0000000005510000-memory.dmp

      Filesize

      64KB

    • memory/1472-8-0x0000000005910000-0x0000000005932000-memory.dmp

      Filesize

      136KB

    • memory/1472-9-0x00000000750B0000-0x0000000075860000-memory.dmp

      Filesize

      7.7MB

    • memory/1472-10-0x0000000005500000-0x0000000005510000-memory.dmp

      Filesize

      64KB

    • memory/1472-0-0x00000000750B0000-0x0000000075860000-memory.dmp

      Filesize

      7.7MB

    • memory/1472-12-0x0000000007000000-0x0000000007060000-memory.dmp

      Filesize

      384KB

    • memory/1472-1-0x0000000000A60000-0x0000000000B66000-memory.dmp

      Filesize

      1.0MB

    • memory/2636-13-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

    • memory/2636-18-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

    • memory/2636-19-0x00000000013E0000-0x00000000013F0000-memory.dmp

      Filesize

      64KB

    • memory/2636-16-0x0000000001520000-0x000000000186A000-memory.dmp

      Filesize

      3.3MB

    • memory/3512-29-0x0000000007F00000-0x0000000008070000-memory.dmp

      Filesize

      1.4MB

    • memory/3512-20-0x0000000007F00000-0x0000000008070000-memory.dmp

      Filesize

      1.4MB

    • memory/3512-36-0x0000000008540000-0x00000000086A7000-memory.dmp

      Filesize

      1.4MB

    • memory/3512-33-0x0000000008540000-0x00000000086A7000-memory.dmp

      Filesize

      1.4MB

    • memory/3512-32-0x0000000008540000-0x00000000086A7000-memory.dmp

      Filesize

      1.4MB

    • memory/3652-21-0x00000000004D0000-0x00000000004EF000-memory.dmp

      Filesize

      124KB

    • memory/3652-28-0x0000000002AF0000-0x0000000002B7F000-memory.dmp

      Filesize

      572KB

    • memory/3652-26-0x0000000000CB0000-0x0000000000CD9000-memory.dmp

      Filesize

      164KB

    • memory/3652-25-0x0000000002C50000-0x0000000002F9A000-memory.dmp

      Filesize

      3.3MB

    • memory/3652-24-0x0000000000CB0000-0x0000000000CD9000-memory.dmp

      Filesize

      164KB

    • memory/3652-23-0x00000000004D0000-0x00000000004EF000-memory.dmp

      Filesize

      124KB