Analysis
- max time kernel
144s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
30/12/2023, 02:20
General
- Target 0b7189ae34ddb29ef3dd133f441f49a7.exe
- Size 1.3MB
- Sample231230-csd3asagek
- SHA256 18ca8210efe21b29666ea86a3e57b02f7b051527185261e2e4d847c1ce885bb7
Malware Config
Extracted
-
xloader
-
2.3
-
ajs8
-
lotfysupport.net
-
tradingsentral.com
-
mobiles240.com
-
redecompre.com
-
mulliganjames.com
-
excursionlanzarote.com
-
n1getaccess.com
-
wirelessconsole.com
-
thevez.net
-
joygshpng.com
-
arandawines.com
-
eliassantis.net
-
racevc.com
-
mybluemonitor.com
-
jual-penggugurkandungan.com
-
connectgf.com
-
nmpsolutions.com
-
anipawesome.com
-
vissito.com
-
terracottagkp.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b7189ae34ddb29ef3dd133f441f49a7.exe"C:\Users\Admin\AppData\Local\Temp\0b7189ae34ddb29ef3dd133f441f49a7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0b7189ae34ddb29ef3dd133f441f49a7.exe"C:\Users\Admin\AppData\Local\Temp\0b7189ae34ddb29ef3dd133f441f49a7.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/220-6-0x0000000006BA0000-0x0000000006C3C000-memory.dmp
memory/220-10-0x0000000006CE0000-0x0000000006D7A000-memory.dmp
memory/220-3-0x00000000053A0000-0x0000000005432000-memory.dmp
memory/220-4-0x0000000005620000-0x0000000005630000-memory.dmp
memory/220-5-0x0000000005460000-0x000000000546A000-memory.dmp
memory/220-0-0x0000000000860000-0x00000000009AA000-memory.dmp
memory/220-2-0x0000000005A60000-0x0000000006004000-memory.dmp
memory/220-8-0x0000000074EA0000-0x0000000075650000-memory.dmp
memory/220-1-0x0000000074EA0000-0x0000000075650000-memory.dmp
memory/220-9-0x0000000005620000-0x0000000005630000-memory.dmp
memory/220-7-0x0000000005930000-0x0000000005942000-memory.dmp
memory/220-11-0x0000000009310000-0x0000000009340000-memory.dmp
memory/220-14-0x0000000074EA0000-0x0000000075650000-memory.dmp
memory/4760-15-0x0000000001510000-0x000000000185A000-memory.dmp
memory/4760-12-0x0000000000400000-0x0000000000429000-memory.dmp