Analysis
- max time kernel
142s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
30/12/2023, 06:24
General
- Target 10fb4d6dd2c8f5821d0d5e7d3c3e3418.exe
- Size 667KB
- Sample231230-g515taeba3
- SHA256 17ca7eec8e12f2ef93e345b31b0af8672034ba270a01ed29f72f2bd57904f2f6
Malware Config
Extracted
-
xloader
-
2.3
-
r48a
-
casaropm.com
-
yatejiaoyu.com
-
camelotandco.com
-
membershipbranding.com
-
eve-tcs.com
-
cravingzapp.com
-
zdflive.com
-
marksthoughtoftheday.com
-
livefutebol.com
-
malibuclassix.com
-
home-job-work.com
-
italifestyleclothing.com
-
integrityrose.life
-
splitfield.com
-
dabanse.com
-
diegobreak.icu
-
luederfleetservices.com
-
beyond-cultures.com
-
baawmar.net
-
quwaza.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\10fb4d6dd2c8f5821d0d5e7d3c3e3418.exe"C:\Users\Admin\AppData\Local\Temp\10fb4d6dd2c8f5821d0d5e7d3c3e3418.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\10fb4d6dd2c8f5821d0d5e7d3c3e3418.exe"C:\Users\Admin\AppData\Local\Temp\10fb4d6dd2c8f5821d0d5e7d3c3e3418.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1544-12-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1544-15-0x0000000001630000-0x000000000197A000-memory.dmp
memory/4500-6-0x0000000005AC0000-0x0000000005ADC000-memory.dmp
memory/4500-3-0x00000000058A0000-0x0000000005932000-memory.dmp
memory/4500-4-0x0000000005B30000-0x0000000005B40000-memory.dmp
memory/4500-5-0x0000000005840000-0x000000000584A000-memory.dmp
memory/4500-0-0x0000000000EF0000-0x0000000000F9E000-memory.dmp
memory/4500-7-0x0000000006F70000-0x000000000700C000-memory.dmp
memory/4500-8-0x0000000074620000-0x0000000074DD0000-memory.dmp
memory/4500-9-0x0000000005B30000-0x0000000005B40000-memory.dmp
memory/4500-10-0x0000000006E10000-0x0000000006E72000-memory.dmp
memory/4500-11-0x0000000009590000-0x00000000095BE000-memory.dmp
memory/4500-2-0x0000000005E50000-0x00000000063F4000-memory.dmp
memory/4500-14-0x0000000074620000-0x0000000074DD0000-memory.dmp
memory/4500-1-0x0000000074620000-0x0000000074DD0000-memory.dmp