Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 20:04

General

  • Target

    3a0f86482d12e9d3a275763997708d9b.exe

  • Size

    1.2MB

  • MD5

    3a0f86482d12e9d3a275763997708d9b

  • SHA1

    3f0c0e46ccc58b066331946101c9c8004fa8c9b2

  • SHA256

    b5918ac7fd3c3323260a3158fe0230b58cdb7098bb659285374e5e2dc1c75f7d

  • SHA512

    a2cad015fcb45163fdff6d99b5518d952635c7b0e19a47b31f8736f8a12ba21df1f13f0fa79e6e749dce826aeda0aa7e1ab42fd6138e96992fce59368bf52b5a

  • SSDEEP

    12288:NYokHiZLn+XEPxm8lh0CmGIwV3r5lUtWeiQR2q0+aeSj1fZ0SW64+mRyK033kwsG:NYccCmDGOsBgo0q4wM3L2q/rKLh3HzM

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

u3r5

Decoy

alashan.ltd

demopagephequan.online

garxznql.icu

unetart.com

dajiangzhibo15.com

influencer.fund

beverlyhills.city

strefafryzur.net

giftboxhawaii.com

ecotiare.com

homeandgardenradioshow.com

sageandsandco.com

laflesoley.com

icipatanegra.online

autovistoriapredial.net

xn--polenezkypark-pmb.com

cbdamic.com

aaronandmarissa.com

datasoma.digital

theclosetology.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • CustAttr .NET packer 1 IoCs

    Detects CustAttr .NET packer in memory.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a0f86482d12e9d3a275763997708d9b.exe
    "C:\Users\Admin\AppData\Local\Temp\3a0f86482d12e9d3a275763997708d9b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Users\Admin\AppData\Local\Temp\3a0f86482d12e9d3a275763997708d9b.exe
      "C:\Users\Admin\AppData\Local\Temp\3a0f86482d12e9d3a275763997708d9b.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1328-16-0x0000000000C10000-0x0000000000F13000-memory.dmp

    Filesize

    3.0MB

  • memory/1328-8-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1328-10-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1328-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1328-14-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2252-6-0x00000000048A0000-0x0000000004918000-memory.dmp

    Filesize

    480KB

  • memory/2252-0-0x0000000000860000-0x00000000009A0000-memory.dmp

    Filesize

    1.2MB

  • memory/2252-7-0x0000000000580000-0x00000000005B0000-memory.dmp

    Filesize

    192KB

  • memory/2252-5-0x0000000004910000-0x0000000004950000-memory.dmp

    Filesize

    256KB

  • memory/2252-15-0x0000000074420000-0x0000000074B0E000-memory.dmp

    Filesize

    6.9MB

  • memory/2252-4-0x0000000074420000-0x0000000074B0E000-memory.dmp

    Filesize

    6.9MB

  • memory/2252-3-0x0000000000360000-0x0000000000372000-memory.dmp

    Filesize

    72KB

  • memory/2252-2-0x0000000004910000-0x0000000004950000-memory.dmp

    Filesize

    256KB

  • memory/2252-1-0x0000000074420000-0x0000000074B0E000-memory.dmp

    Filesize

    6.9MB