Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/12/2023, 00:59

General

  • Target

    bd4acec724764aff79889c171a7fa327.exe

  • Size

    1.2MB

  • MD5

    bd4acec724764aff79889c171a7fa327

  • SHA1

    2bdfc8ae9840d7be4da6412fbdf5eb8c072ac048

  • SHA256

    f922e5ed74050041bbdad3ab177c8c14d18c9147827b58e4bce90631c513cb6e

  • SHA512

    6d0e92c6eef66136dfdc29f0dcc065481eb3697bc76153f9cdc820e9fde5429a5e45190570ef3bff4edc33d2803943328995b5543379ed5ee10837d76d6d4a5a

  • SSDEEP

    24576:HUOsBgo0q4wM8BmCmTOUd+L6kyXWJP389UZAtRm0gtZL8W6Su:HdoHMkmCm6Ud+zyXy389qAfxgDvu

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

h388

Decoy

americangrindstone.com

qdy6.club

bestsecretrecipes.info

11restoran.com

mrhashtags.com

theexecutivestudio.com

levilatte.com

indiantrio.com

msdhigh.com

spartandiesel.com

soccersundays.com

eliteworldcars.com

superlemon001.com

greenlight.school

kuryeforum.xyz

abc-322.com

campbellretreat.com

argonmode.net

movievilla.info

brateix.info

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • CustAttr .NET packer 1 IoCs

    Detects CustAttr .NET packer in memory.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd4acec724764aff79889c171a7fa327.exe
    "C:\Users\Admin\AppData\Local\Temp\bd4acec724764aff79889c171a7fa327.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Users\Admin\AppData\Local\Temp\bd4acec724764aff79889c171a7fa327.exe
      "C:\Users\Admin\AppData\Local\Temp\bd4acec724764aff79889c171a7fa327.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1196-8-0x0000000004E10000-0x0000000004E22000-memory.dmp

    Filesize

    72KB

  • memory/1196-9-0x00000000744A0000-0x0000000074C50000-memory.dmp

    Filesize

    7.7MB

  • memory/1196-5-0x0000000004E20000-0x0000000004E30000-memory.dmp

    Filesize

    64KB

  • memory/1196-7-0x0000000004DB0000-0x0000000004E06000-memory.dmp

    Filesize

    344KB

  • memory/1196-6-0x0000000004C40000-0x0000000004C4A000-memory.dmp

    Filesize

    40KB

  • memory/1196-2-0x0000000004B20000-0x0000000004BBC000-memory.dmp

    Filesize

    624KB

  • memory/1196-4-0x0000000004CB0000-0x0000000004D42000-memory.dmp

    Filesize

    584KB

  • memory/1196-0-0x0000000000070000-0x00000000001B0000-memory.dmp

    Filesize

    1.2MB

  • memory/1196-3-0x00000000051C0000-0x0000000005764000-memory.dmp

    Filesize

    5.6MB

  • memory/1196-1-0x00000000744A0000-0x0000000074C50000-memory.dmp

    Filesize

    7.7MB

  • memory/1196-10-0x00000000066F0000-0x000000000676C000-memory.dmp

    Filesize

    496KB

  • memory/1196-14-0x00000000744A0000-0x0000000074C50000-memory.dmp

    Filesize

    7.7MB

  • memory/1196-11-0x0000000005C50000-0x0000000005C84000-memory.dmp

    Filesize

    208KB

  • memory/4300-15-0x0000000001B80000-0x0000000001ECA000-memory.dmp

    Filesize

    3.3MB

  • memory/4300-12-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/4300-16-0x0000000001B80000-0x0000000001ECA000-memory.dmp

    Filesize

    3.3MB