Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    28/12/2023, 00:59

General

  • Target

    bd4acec724764aff79889c171a7fa327.exe

  • Size

    1.2MB

  • MD5

    bd4acec724764aff79889c171a7fa327

  • SHA1

    2bdfc8ae9840d7be4da6412fbdf5eb8c072ac048

  • SHA256

    f922e5ed74050041bbdad3ab177c8c14d18c9147827b58e4bce90631c513cb6e

  • SHA512

    6d0e92c6eef66136dfdc29f0dcc065481eb3697bc76153f9cdc820e9fde5429a5e45190570ef3bff4edc33d2803943328995b5543379ed5ee10837d76d6d4a5a

  • SSDEEP

    24576:HUOsBgo0q4wM8BmCmTOUd+L6kyXWJP389UZAtRm0gtZL8W6Su:HdoHMkmCm6Ud+zyXy389qAfxgDvu

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

h388

Decoy

americangrindstone.com

qdy6.club

bestsecretrecipes.info

11restoran.com

mrhashtags.com

theexecutivestudio.com

levilatte.com

indiantrio.com

msdhigh.com

spartandiesel.com

soccersundays.com

eliteworldcars.com

superlemon001.com

greenlight.school

kuryeforum.xyz

abc-322.com

campbellretreat.com

argonmode.net

movievilla.info

brateix.info

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • CustAttr .NET packer 1 IoCs

    Detects CustAttr .NET packer in memory.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd4acec724764aff79889c171a7fa327.exe
    "C:\Users\Admin\AppData\Local\Temp\bd4acec724764aff79889c171a7fa327.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Users\Admin\AppData\Local\Temp\bd4acec724764aff79889c171a7fa327.exe
      "C:\Users\Admin\AppData\Local\Temp\bd4acec724764aff79889c171a7fa327.exe"
      2⤵
        PID:2684
      • C:\Users\Admin\AppData\Local\Temp\bd4acec724764aff79889c171a7fa327.exe
        "C:\Users\Admin\AppData\Local\Temp\bd4acec724764aff79889c171a7fa327.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2608

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1680-6-0x00000000054B0000-0x000000000552C000-memory.dmp

      Filesize

      496KB

    • memory/1680-7-0x0000000000510000-0x0000000000544000-memory.dmp

      Filesize

      208KB

    • memory/1680-2-0x0000000004D70000-0x0000000004DB0000-memory.dmp

      Filesize

      256KB

    • memory/1680-3-0x0000000000460000-0x0000000000472000-memory.dmp

      Filesize

      72KB

    • memory/1680-4-0x0000000073FD0000-0x00000000746BE000-memory.dmp

      Filesize

      6.9MB

    • memory/1680-5-0x0000000004D70000-0x0000000004DB0000-memory.dmp

      Filesize

      256KB

    • memory/1680-0-0x0000000000150000-0x0000000000290000-memory.dmp

      Filesize

      1.2MB

    • memory/1680-13-0x0000000073FD0000-0x00000000746BE000-memory.dmp

      Filesize

      6.9MB

    • memory/1680-1-0x0000000073FD0000-0x00000000746BE000-memory.dmp

      Filesize

      6.9MB

    • memory/2608-12-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

    • memory/2608-14-0x00000000009E0000-0x0000000000CE3000-memory.dmp

      Filesize

      3.0MB

    • memory/2608-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2608-9-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

    • memory/2608-8-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

    • memory/2608-15-0x00000000009E0000-0x0000000000CE3000-memory.dmp

      Filesize

      3.0MB