Analysis

  • max time kernel
    122s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    28/12/2023, 03:32

General

  • Target

    c04f70436cf53db113a202251a48c4a5.exe

  • Size

    1.3MB

  • MD5

    c04f70436cf53db113a202251a48c4a5

  • SHA1

    f677a68c0cf634372001f5506c6681e06e5120a9

  • SHA256

    98308710dc37148bf2d9b00829e791e1b2eb92703e1cd80b13e9e1a58d751651

  • SHA512

    3ea3b4d42e969595cf8a1309aa16aad8728a70a93101864e7a240101c8dcb166e11aec18b2130202b9e9da6d97d0ad96e58786f39a392ec12b04ebd228f76429

  • SSDEEP

    24576:G3S/d3YKzks/ksNBRWSnlbLF8CRAd56w/PdGhopy8jhMN6ZNbZ:oKJBRfnFFZUoishopCN6ZNb

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

c8ec

Decoy

kingmeters.com

thawoman.com

cannabisinseconds.com

3966399.com

grabopolska.online

krystalpacifico.com

quibii.com

wangzhanceshi.online

blog-techtalks.com

refreshlightingcompany.com

justrightmap.net

sewabhartidelhi.com

noharminmasking.com

speedysignin.website

schwabinsttutional.com

carbon2algae.com

pateleprevention.com

techsavypinaki.com

onemindafrica.com

flowerpeony.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • CustAttr .NET packer 1 IoCs

    Detects CustAttr .NET packer in memory.

  • Xloader payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c04f70436cf53db113a202251a48c4a5.exe
    "C:\Users\Admin\AppData\Local\Temp\c04f70436cf53db113a202251a48c4a5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Users\Admin\AppData\Local\Temp\c04f70436cf53db113a202251a48c4a5.exe
      "C:\Users\Admin\AppData\Local\Temp\c04f70436cf53db113a202251a48c4a5.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2112-8-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2112-15-0x0000000000AC0000-0x0000000000DC3000-memory.dmp

    Filesize

    3.0MB

  • memory/2112-14-0x0000000000AC0000-0x0000000000DC3000-memory.dmp

    Filesize

    3.0MB

  • memory/2112-9-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2112-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2112-12-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2176-3-0x0000000000370000-0x0000000000382000-memory.dmp

    Filesize

    72KB

  • memory/2176-7-0x0000000001FF0000-0x000000000201E000-memory.dmp

    Filesize

    184KB

  • memory/2176-6-0x0000000005560000-0x0000000005600000-memory.dmp

    Filesize

    640KB

  • memory/2176-5-0x0000000000670000-0x00000000006B0000-memory.dmp

    Filesize

    256KB

  • memory/2176-13-0x00000000749D0000-0x00000000750BE000-memory.dmp

    Filesize

    6.9MB

  • memory/2176-4-0x00000000749D0000-0x00000000750BE000-memory.dmp

    Filesize

    6.9MB

  • memory/2176-0-0x00000000749D0000-0x00000000750BE000-memory.dmp

    Filesize

    6.9MB

  • memory/2176-2-0x0000000000670000-0x00000000006B0000-memory.dmp

    Filesize

    256KB

  • memory/2176-1-0x00000000000B0000-0x00000000001FA000-memory.dmp

    Filesize

    1.3MB