Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/12/2023, 00:36

General

  • Target

    bc8db9869cafb1a79072aca3b18ca3ad.exe

  • Size

    1.3MB

  • MD5

    bc8db9869cafb1a79072aca3b18ca3ad

  • SHA1

    98ff05f90f1c7bad85cc6a85d60fdff2cef8cb36

  • SHA256

    8881345e69d32ff3178d762456a96927b45f0236e2ddf2ffcb57db02340c67bd

  • SHA512

    1de92c8e160d330280494f71356284b8791f7cfb9c2e78ddfd52bd85b3ef9ede2d173ffa3d22e2819dabf5b868f19821a5385fd10065a21be1c2856cfe02ef4a

  • SSDEEP

    24576:DJscW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+huE:N6iecXqMQI8oEdqNQuiNB/e7

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

h388

Decoy

americangrindstone.com

qdy6.club

bestsecretrecipes.info

11restoran.com

mrhashtags.com

theexecutivestudio.com

levilatte.com

indiantrio.com

msdhigh.com

spartandiesel.com

soccersundays.com

eliteworldcars.com

superlemon001.com

greenlight.school

kuryeforum.xyz

abc-322.com

campbellretreat.com

argonmode.net

movievilla.info

brateix.info

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc8db9869cafb1a79072aca3b18ca3ad.exe
    "C:\Users\Admin\AppData\Local\Temp\bc8db9869cafb1a79072aca3b18ca3ad.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:540
    • C:\Users\Admin\AppData\Local\Temp\bc8db9869cafb1a79072aca3b18ca3ad.exe
      "C:\Users\Admin\AppData\Local\Temp\bc8db9869cafb1a79072aca3b18ca3ad.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/540-8-0x0000000002D00000-0x0000000002D36000-memory.dmp

    Filesize

    216KB

  • memory/540-9-0x0000000074AB0000-0x0000000075260000-memory.dmp

    Filesize

    7.7MB

  • memory/540-0-0x0000000000A70000-0x0000000000BC8000-memory.dmp

    Filesize

    1.3MB

  • memory/540-3-0x0000000005AA0000-0x0000000006044000-memory.dmp

    Filesize

    5.6MB

  • memory/540-4-0x0000000005590000-0x0000000005622000-memory.dmp

    Filesize

    584KB

  • memory/540-6-0x0000000005520000-0x000000000552A000-memory.dmp

    Filesize

    40KB

  • memory/540-7-0x0000000005720000-0x0000000005776000-memory.dmp

    Filesize

    344KB

  • memory/540-5-0x0000000005810000-0x0000000005820000-memory.dmp

    Filesize

    64KB

  • memory/540-1-0x0000000074AB0000-0x0000000075260000-memory.dmp

    Filesize

    7.7MB

  • memory/540-10-0x0000000005810000-0x0000000005820000-memory.dmp

    Filesize

    64KB

  • memory/540-2-0x0000000005450000-0x00000000054EC000-memory.dmp

    Filesize

    624KB

  • memory/540-11-0x0000000006830000-0x00000000068A8000-memory.dmp

    Filesize

    480KB

  • memory/540-15-0x0000000074AB0000-0x0000000075260000-memory.dmp

    Filesize

    7.7MB

  • memory/540-12-0x0000000005830000-0x0000000005860000-memory.dmp

    Filesize

    192KB

  • memory/4792-13-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/4792-16-0x0000000000FC0000-0x000000000130A000-memory.dmp

    Filesize

    3.3MB

  • memory/4792-17-0x0000000000FC0000-0x000000000130A000-memory.dmp

    Filesize

    3.3MB