Analysis
-
max time kernel
46s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 01:52
Static task
static1
Behavioral task
behavioral1
Sample
PO24535363.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
PO24535363.exe
Resource
win10v2004-20231215-en
General
-
Target
PO24535363.exe
-
Size
810KB
-
MD5
cad47481ee480d7808407d1b82c59d6b
-
SHA1
ea048eee92361095b568fbc8de772a6788e186d1
-
SHA256
590387feecd3df6131ffd646c5e4a9e597b6e216c56d7a1eb010b16164281144
-
SHA512
4d245ed227a62e2b3c2dfca61f20bc6fa5c81c09ca1c87c0292f21db39a936c81942f37f365b3357348aa022508d19bd152285d0930efd7e7633c355c9c115e6
-
SSDEEP
12288:GxdOwKLvAcdZYkMypFtK+1mATyZVKy3jnYZdLKSb55cRANAZCAAb/9nMAzN4F6/c:GnORAcPMO1g3jngBbQQ
Malware Config
Extracted
xloader
2.3
dfa8
rocketgoldcorp.com
bdsportslive.com
szldbxg.com
teavelersjournal.com
nilmiro.com
empporiocar.com
xishuophp.net
multigremiosmadrid.com
tucsonlot.com
fitnessketo.com
ourhomeimprovements.com
fletcher-windows.com
shab834.com
neggouyadla.com
helps-support.net
waterst.one
schoolforshapers.com
shubhshaktinidhi.com
vintatts.com
ykmmailer18.com
bellsma.com
shakibeautybrand.com
dhakasomoy.com
bentubuo.com
yourdoingamazingsweetie.com
hobiarwana.com
coguxama.com
tsakonianarchives.directory
fleurdelys-vungtau.com
quiqmediatools.com
easyshelfet.com
platesteam.net
learntechterms.com
twistedcolorpaintingpros.com
brookspathway.com
overblijfplanner.com
hikingisourministry.com
arthurgphelps.com
ddtv15.com
4jinbo.com
bridgendmunicipalbowlsclub.com
jojosdrop.com
helanmtmbox.com
wallet-tx-blochcaln.info
tymcallistersales.com
boomslzp.com
hnhengban.com
westpalmbeach.digital
archivenepal.com
pasabalikdoner.xyz
wxdjdz.com
hamptonshammock.com
naturalfixproject.com
gfrin.com
mmxxcollective.com
kilconconcreting.com
racevc.com
evocutnutritionstore.com
londoncityroyals.com
greatcoral.com
betshop.club
44idc.net
austincitylegacy.net
makeamericagreatagain2021.com
valorantpointsstore.com
Signatures
-
Xloader payload 5 IoCs
resource yara_rule behavioral1/memory/2764-24-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2764-19-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2764-29-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1880-34-0x0000000000110000-0x0000000000139000-memory.dmp xloader behavioral1/memory/1880-36-0x0000000000110000-0x0000000000139000-memory.dmp xloader -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2880 schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO24535363.exe"C:\Users\Admin\AppData\Local\Temp\PO24535363.exe"1⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\PO24535363.exe"C:\Users\Admin\AppData\Local\Temp\PO24535363.exe"2⤵PID:2764
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NCgjtGQWUsw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB193.tmp"2⤵
- Creates scheduled task(s)
PID:2880
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"1⤵PID:1880
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO24535363.exe"2⤵PID:2548
-