Analysis
- max time kernel
140s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
30/12/2023, 21:58
General
- Target 1dce0fc0bcc3ed4f7af74bdaeef37a5f.exe
- Size 1.2MB
- Sample231230-1vnaragegp
- SHA256 e8bb9e81ed75437b45f90b1c65e3100c618090d66d7fa37f5208fedc6972f142
Malware Config
Extracted
-
xloader
-
2.3
-
wten
-
largshomebuyers.com
-
hqs.xyz
-
stormvalleysoapco.com
-
coolsoftware.xyz
-
creditfitbootcamp.com
-
mdroc.com
-
cooperseyewear.com
-
mrleyos.com
-
apipacking.com
-
mtdivas.com
-
bim3dstudio.com
-
ngdnwgtsf.club
-
arknmhsc.com
-
expowe.icu
-
surfacesupplierscanada.com
-
thinbluelion.com
-
vbetmalaysia.com
-
christcarriers.com
-
easternshoreautobody.com
-
healthyvibrantandbeautiful.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dce0fc0bcc3ed4f7af74bdaeef37a5f.exe"C:\Users\Admin\AppData\Local\Temp\1dce0fc0bcc3ed4f7af74bdaeef37a5f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1dce0fc0bcc3ed4f7af74bdaeef37a5f.exe"C:\Users\Admin\AppData\Local\Temp\1dce0fc0bcc3ed4f7af74bdaeef37a5f.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1dce0fc0bcc3ed4f7af74bdaeef37a5f.exe"C:\Users\Admin\AppData\Local\Temp\1dce0fc0bcc3ed4f7af74bdaeef37a5f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1564-1-0x0000000074DD0000-0x0000000075580000-memory.dmp
memory/1564-0-0x0000000000CE0000-0x0000000000E1C000-memory.dmp
memory/1564-2-0x0000000005800000-0x000000000589C000-memory.dmp
memory/1564-3-0x0000000005E50000-0x00000000063F4000-memory.dmp
memory/1564-4-0x0000000005940000-0x00000000059D2000-memory.dmp
memory/1564-5-0x0000000005790000-0x00000000057A0000-memory.dmp
memory/1564-6-0x00000000058C0000-0x00000000058CA000-memory.dmp
memory/1564-7-0x0000000005AD0000-0x0000000005B26000-memory.dmp
memory/1564-8-0x0000000005900000-0x0000000005912000-memory.dmp
memory/1564-9-0x0000000074DD0000-0x0000000075580000-memory.dmp
memory/1564-10-0x00000000072E0000-0x000000000735C000-memory.dmp
memory/1564-11-0x0000000006880000-0x00000000068B4000-memory.dmp
memory/1564-14-0x0000000074DD0000-0x0000000075580000-memory.dmp
memory/4388-15-0x00000000017A0000-0x0000000001AEA000-memory.dmp
memory/4388-12-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4388-16-0x00000000017A0000-0x0000000001AEA000-memory.dmp