Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    28/12/2023, 00:36

General

  • Target

    bc8db9869cafb1a79072aca3b18ca3ad.exe

  • Size

    1.3MB

  • MD5

    bc8db9869cafb1a79072aca3b18ca3ad

  • SHA1

    98ff05f90f1c7bad85cc6a85d60fdff2cef8cb36

  • SHA256

    8881345e69d32ff3178d762456a96927b45f0236e2ddf2ffcb57db02340c67bd

  • SHA512

    1de92c8e160d330280494f71356284b8791f7cfb9c2e78ddfd52bd85b3ef9ede2d173ffa3d22e2819dabf5b868f19821a5385fd10065a21be1c2856cfe02ef4a

  • SSDEEP

    24576:DJscW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+huE:N6iecXqMQI8oEdqNQuiNB/e7

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

h388

Decoy

americangrindstone.com

qdy6.club

bestsecretrecipes.info

11restoran.com

mrhashtags.com

theexecutivestudio.com

levilatte.com

indiantrio.com

msdhigh.com

spartandiesel.com

soccersundays.com

eliteworldcars.com

superlemon001.com

greenlight.school

kuryeforum.xyz

abc-322.com

campbellretreat.com

argonmode.net

movievilla.info

brateix.info

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc8db9869cafb1a79072aca3b18ca3ad.exe
    "C:\Users\Admin\AppData\Local\Temp\bc8db9869cafb1a79072aca3b18ca3ad.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Users\Admin\AppData\Local\Temp\bc8db9869cafb1a79072aca3b18ca3ad.exe
      "C:\Users\Admin\AppData\Local\Temp\bc8db9869cafb1a79072aca3b18ca3ad.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2524-8-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2524-14-0x00000000008D0000-0x0000000000BD3000-memory.dmp

    Filesize

    3.0MB

  • memory/2524-12-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2524-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2524-9-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/3044-3-0x0000000000200000-0x0000000000236000-memory.dmp

    Filesize

    216KB

  • memory/3044-6-0x0000000000C50000-0x0000000000CC8000-memory.dmp

    Filesize

    480KB

  • memory/3044-7-0x0000000000620000-0x0000000000650000-memory.dmp

    Filesize

    192KB

  • memory/3044-5-0x0000000004FF0000-0x0000000005030000-memory.dmp

    Filesize

    256KB

  • memory/3044-4-0x0000000074DC0000-0x00000000754AE000-memory.dmp

    Filesize

    6.9MB

  • memory/3044-0-0x0000000000CC0000-0x0000000000E18000-memory.dmp

    Filesize

    1.3MB

  • memory/3044-2-0x0000000004FF0000-0x0000000005030000-memory.dmp

    Filesize

    256KB

  • memory/3044-13-0x0000000074DC0000-0x00000000754AE000-memory.dmp

    Filesize

    6.9MB

  • memory/3044-1-0x0000000074DC0000-0x00000000754AE000-memory.dmp

    Filesize

    6.9MB