Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 06:30

General

  • Target

    111d2be6108ec665c15caae8b6964387.exe

  • Size

    1.3MB

  • MD5

    111d2be6108ec665c15caae8b6964387

  • SHA1

    04228ee5fb9fbe16b3a6406f64a067c15d549faa

  • SHA256

    69a08fcc2b3eb5499a9356a801bb646d7726dc158cba7f141335997f374ead38

  • SHA512

    2fcf5640c8fc5d08ed6737caab9fe8f359671f272b1a0992c360887e6166597b9cfd7c5efe7b5e2c418b0e9dd0392e54ea4bfe1b7aa62437cc509869f49c2a94

  • SSDEEP

    24576:oKIUradyDYzq7qbJvrd3nKivWV/Nm/y12Nhmk+p:nIqadyM27qbFrZJdyYw

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ssee

Decoy

portalcanaa.com

korzino.com

dlylms.net

smartearphoneshop.com

olimiloshop.com

auvdigitalstack.com

ydxc.chat

yhk868.com

lifeinthedport.com

self-sciencelabs.com

scandicpack.com

hold-sometimes.xyz

beiputei.com

yourrealtorcoach.com

rxods.com

fundsoption.com

ahlstromclothes.com

ksdieselparts.com

accountmangerford.com

kuwaitlogistic.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\111d2be6108ec665c15caae8b6964387.exe
    "C:\Users\Admin\AppData\Local\Temp\111d2be6108ec665c15caae8b6964387.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Users\Admin\AppData\Local\Temp\111d2be6108ec665c15caae8b6964387.exe
      "C:\Users\Admin\AppData\Local\Temp\111d2be6108ec665c15caae8b6964387.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1816-12-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1816-16-0x00000000011B0000-0x00000000014FA000-memory.dmp

    Filesize

    3.3MB

  • memory/1816-15-0x00000000011B0000-0x00000000014FA000-memory.dmp

    Filesize

    3.3MB

  • memory/2644-4-0x0000000005060000-0x0000000005070000-memory.dmp

    Filesize

    64KB

  • memory/2644-0-0x0000000075330000-0x0000000075AE0000-memory.dmp

    Filesize

    7.7MB

  • memory/2644-5-0x00000000050C0000-0x00000000050CA000-memory.dmp

    Filesize

    40KB

  • memory/2644-6-0x0000000005350000-0x000000000536C000-memory.dmp

    Filesize

    112KB

  • memory/2644-7-0x00000000064C0000-0x000000000655C000-memory.dmp

    Filesize

    624KB

  • memory/2644-8-0x0000000075330000-0x0000000075AE0000-memory.dmp

    Filesize

    7.7MB

  • memory/2644-9-0x0000000005060000-0x0000000005070000-memory.dmp

    Filesize

    64KB

  • memory/2644-10-0x0000000007E90000-0x0000000007F1C000-memory.dmp

    Filesize

    560KB

  • memory/2644-11-0x000000000A5A0000-0x000000000A5F8000-memory.dmp

    Filesize

    352KB

  • memory/2644-3-0x0000000005160000-0x00000000051F2000-memory.dmp

    Filesize

    584KB

  • memory/2644-14-0x0000000075330000-0x0000000075AE0000-memory.dmp

    Filesize

    7.7MB

  • memory/2644-2-0x0000000005670000-0x0000000005C14000-memory.dmp

    Filesize

    5.6MB

  • memory/2644-1-0x0000000000560000-0x00000000006AE000-memory.dmp

    Filesize

    1.3MB