Analysis

  • max time kernel
    161s
  • max time network
    176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/12/2023, 03:32

General

  • Target

    c04f70436cf53db113a202251a48c4a5.exe

  • Size

    1.3MB

  • MD5

    c04f70436cf53db113a202251a48c4a5

  • SHA1

    f677a68c0cf634372001f5506c6681e06e5120a9

  • SHA256

    98308710dc37148bf2d9b00829e791e1b2eb92703e1cd80b13e9e1a58d751651

  • SHA512

    3ea3b4d42e969595cf8a1309aa16aad8728a70a93101864e7a240101c8dcb166e11aec18b2130202b9e9da6d97d0ad96e58786f39a392ec12b04ebd228f76429

  • SSDEEP

    24576:G3S/d3YKzks/ksNBRWSnlbLF8CRAd56w/PdGhopy8jhMN6ZNbZ:oKJBRfnFFZUoishopCN6ZNb

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

c8ec

Decoy

kingmeters.com

thawoman.com

cannabisinseconds.com

3966399.com

grabopolska.online

krystalpacifico.com

quibii.com

wangzhanceshi.online

blog-techtalks.com

refreshlightingcompany.com

justrightmap.net

sewabhartidelhi.com

noharminmasking.com

speedysignin.website

schwabinsttutional.com

carbon2algae.com

pateleprevention.com

techsavypinaki.com

onemindafrica.com

flowerpeony.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • CustAttr .NET packer 1 IoCs

    Detects CustAttr .NET packer in memory.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c04f70436cf53db113a202251a48c4a5.exe
    "C:\Users\Admin\AppData\Local\Temp\c04f70436cf53db113a202251a48c4a5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Users\Admin\AppData\Local\Temp\c04f70436cf53db113a202251a48c4a5.exe
      "C:\Users\Admin\AppData\Local\Temp\c04f70436cf53db113a202251a48c4a5.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2172-6-0x0000000005B50000-0x0000000005BEC000-memory.dmp

    Filesize

    624KB

  • memory/2172-10-0x0000000006700000-0x00000000067A0000-memory.dmp

    Filesize

    640KB

  • memory/2172-2-0x0000000005D90000-0x0000000006334000-memory.dmp

    Filesize

    5.6MB

  • memory/2172-3-0x0000000005880000-0x0000000005912000-memory.dmp

    Filesize

    584KB

  • memory/2172-4-0x00000000059A0000-0x00000000059B0000-memory.dmp

    Filesize

    64KB

  • memory/2172-5-0x0000000005930000-0x000000000593A000-memory.dmp

    Filesize

    40KB

  • memory/2172-1-0x0000000000E80000-0x0000000000FCA000-memory.dmp

    Filesize

    1.3MB

  • memory/2172-8-0x0000000074DD0000-0x0000000075580000-memory.dmp

    Filesize

    7.7MB

  • memory/2172-0-0x0000000074DD0000-0x0000000075580000-memory.dmp

    Filesize

    7.7MB

  • memory/2172-9-0x00000000059A0000-0x00000000059B0000-memory.dmp

    Filesize

    64KB

  • memory/2172-7-0x0000000005990000-0x00000000059A2000-memory.dmp

    Filesize

    72KB

  • memory/2172-11-0x0000000001770000-0x000000000179E000-memory.dmp

    Filesize

    184KB

  • memory/2172-15-0x0000000074DD0000-0x0000000075580000-memory.dmp

    Filesize

    7.7MB

  • memory/4984-14-0x0000000001190000-0x00000000014DA000-memory.dmp

    Filesize

    3.3MB

  • memory/4984-12-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB