Analysis
- max time kernel
144s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
30/12/2023, 04:48
General
- Target 0f03eab5505bb4a4df99ccead0fc28f4.exe
- Size 1.0MB
- Sample231230-ffhfqsafa9
- SHA256 aaa40ee2b509dc2b3a2f12f62d70565c85eb9aa13a7efd43bb86cfba0a3e1a88
Malware Config
Extracted
-
xloader
-
2.3
-
ushb
-
shopcavo.com
-
spowerschool.com
-
freekylerittenhouse.info
-
wipe4all.com
-
wounded-deer.com
-
poetasamigosypensadores.com
-
qteap.com
-
car-bingo.com
-
selbaje.com
-
amigofincorp.com
-
dirty-underwear.com
-
theyongeseries.com
-
watertreeinc.com
-
gemmacarulla.com
-
lauramagni.com
-
darkfliks.com
-
jjayphoto.com
-
chinnanmotors.com
-
intentionaltalentsolutions.com
-
oxiaer.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f03eab5505bb4a4df99ccead0fc28f4.exe"C:\Users\Admin\AppData\Local\Temp\0f03eab5505bb4a4df99ccead0fc28f4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0f03eab5505bb4a4df99ccead0fc28f4.exe"C:\Users\Admin\AppData\Local\Temp\0f03eab5505bb4a4df99ccead0fc28f4.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2016-8-0x0000000005C00000-0x0000000005C12000-memory.dmp
memory/2016-9-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/2016-2-0x0000000005890000-0x000000000592C000-memory.dmp
memory/2016-3-0x0000000005F90000-0x0000000006534000-memory.dmp
memory/2016-4-0x00000000059E0000-0x0000000005A72000-memory.dmp
memory/2016-5-0x0000000005C50000-0x0000000005C60000-memory.dmp
memory/2016-1-0x0000000000DD0000-0x0000000000EDE000-memory.dmp
memory/2016-6-0x0000000005960000-0x000000000596A000-memory.dmp
memory/2016-0-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/2016-7-0x0000000005B80000-0x0000000005BD6000-memory.dmp
memory/2016-10-0x0000000005C50000-0x0000000005C60000-memory.dmp
memory/2016-11-0x00000000070B0000-0x0000000007126000-memory.dmp
memory/2016-12-0x0000000007190000-0x00000000071C0000-memory.dmp
memory/2016-15-0x0000000074BD0000-0x0000000075380000-memory.dmp
memory/3956-13-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3956-16-0x00000000019F0000-0x0000000001D3A000-memory.dmp