Analysis

  • max time kernel
    118s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 05:08

General

  • Target

    0f9ed47f1ffe3b1cd242b7872f4ce341.exe

  • Size

    260KB

  • MD5

    0f9ed47f1ffe3b1cd242b7872f4ce341

  • SHA1

    37c2b669d727b1aec796644c1f4f884f0ad86944

  • SHA256

    d7abd3634174ad687ef4153f268667361c7177b73871c7dbd296659d918e0d36

  • SHA512

    b739a86c7ba735fe40e7630603519d2383b7615ab5c96780138455496da804e19a3d8b3228afb98403b84cdf9b769b064af899f173dd044bd313b1e32d4a18bf

  • SSDEEP

    6144:wM0XSGZqaz2EZTSBXSQOpkAVNGo2c/FejeqlbgMF:wfSGZzztOBXcpk2GogN

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

c28h

Decoy

xn--osegredodameditao-nqb9e.com

blakepleasant.com

midnightindulgence.com

lungx.com

goldenretrieversmn.com

thecapshooter.com

luxuryledlighting.com

coachlind.com

jewelryart-byirene.com

legacyvending.net

staffjet.info

geogest.com

okmulgeedream.center

mexicoifbbproleague.net

tomrings.com

kidsomia.com

learnwithalinguist.com

getboardsuited.com

aiyuc.com

wowmanship.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f9ed47f1ffe3b1cd242b7872f4ce341.exe
    "C:\Users\Admin\AppData\Local\Temp\0f9ed47f1ffe3b1cd242b7872f4ce341.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Users\Admin\AppData\Local\Temp\0f9ed47f1ffe3b1cd242b7872f4ce341.exe
      "C:\Users\Admin\AppData\Local\Temp\0f9ed47f1ffe3b1cd242b7872f4ce341.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1752-0-0x0000000000370000-0x000000000037E000-memory.dmp

    Filesize

    56KB

  • memory/1752-1-0x0000000000140000-0x0000000000142000-memory.dmp

    Filesize

    8KB

  • memory/2124-2-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2124-3-0x0000000000AC0000-0x0000000000DC3000-memory.dmp

    Filesize

    3.0MB