Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 20:06

General

  • Target

    3a2b189ba8182eb62ea6bfc27e8ca898.exe

  • Size

    1.3MB

  • MD5

    3a2b189ba8182eb62ea6bfc27e8ca898

  • SHA1

    4dbb07cf112a88e1a90517102d281f12825d2c83

  • SHA256

    f988c17ff348d65c83b031d164e3a3850b38f4e6b2c43cd426dfafd68474301a

  • SHA512

    e73ce3cc077a7daecc58ad8b3de749cf19cc0f8e49c516f4fca3caeb0179073984df76a2113372131d7c3873f022d7210dce49d676913b12c615663cc4cf1460

  • SSDEEP

    24576:rn+S/d3lYdkeDPEyZzgz8F59dbZt/SQIIgRmw2GPoN7vdiTbnFM:oRPE4zvF5nZt/DVgRmsPoiM

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

wufn

Decoy

rsautoluxe.com

theroseofsharonsalon.com

singnema.com

nathanielwhite108.com

theforumonline.com

iqpt.info

joneshondaservice.com

fafene.com

solanohomebuyerclass.com

zwq.xyz

searchlakeconroehomes.com

briative.com

frystmor.city

systemofyouth.com

sctsmney.com

tv-safetrading.com

thesweetboy.com

occulusblu.com

pawsthemomentpetphotography.com

travelstipsguide.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • CustAttr .NET packer 1 IoCs

    Detects CustAttr .NET packer in memory.

  • Xloader payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a2b189ba8182eb62ea6bfc27e8ca898.exe
    "C:\Users\Admin\AppData\Local\Temp\3a2b189ba8182eb62ea6bfc27e8ca898.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Users\Admin\AppData\Local\Temp\3a2b189ba8182eb62ea6bfc27e8ca898.exe
      "C:\Users\Admin\AppData\Local\Temp\3a2b189ba8182eb62ea6bfc27e8ca898.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1732-6-0x00000000058B0000-0x000000000594E000-memory.dmp

    Filesize

    632KB

  • memory/1732-7-0x0000000000530000-0x000000000055E000-memory.dmp

    Filesize

    184KB

  • memory/1732-2-0x0000000005020000-0x0000000005060000-memory.dmp

    Filesize

    256KB

  • memory/1732-3-0x0000000000480000-0x0000000000492000-memory.dmp

    Filesize

    72KB

  • memory/1732-4-0x00000000747F0000-0x0000000074EDE000-memory.dmp

    Filesize

    6.9MB

  • memory/1732-5-0x0000000005020000-0x0000000005060000-memory.dmp

    Filesize

    256KB

  • memory/1732-1-0x00000000747F0000-0x0000000074EDE000-memory.dmp

    Filesize

    6.9MB

  • memory/1732-15-0x00000000747F0000-0x0000000074EDE000-memory.dmp

    Filesize

    6.9MB

  • memory/1732-0-0x0000000000D30000-0x0000000000E84000-memory.dmp

    Filesize

    1.3MB

  • memory/2724-10-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2724-8-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2724-14-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2724-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2724-16-0x0000000000820000-0x0000000000B23000-memory.dmp

    Filesize

    3.0MB

  • memory/2724-17-0x0000000000820000-0x0000000000B23000-memory.dmp

    Filesize

    3.0MB