Analysis
- max time kernel
153s - max time network
165s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
30/12/2023, 10:07
General
- Target 1560a70e2817b033e408e2b6f01d61f3.exe
- Size 595KB
- Sample231230-l53qvsedcm
- SHA256 abf766b720d305571da8045801395293eadbea023e225d60bc3bbea7e8ca0f2d
Malware Config
Extracted
-
xloader
-
2.3
-
vc20
-
222gu7com-888888gu7app.com
-
richb.online
-
lindaplusch.com
-
polarisjunctionapts.com
-
vrolin.com
-
duncanvillebouncehouse.com
-
coldnationmusic.com
-
afamegagt.com
-
mariospizzanewark.com
-
jinggouwg.com
-
yourandromeda-es.com
-
fanuron.com
-
bestv.xyz
-
palhh.com
-
pcsoftwaresdownload.com
-
courseyblvd.com
-
jupiterpcrepair.com
-
tmtiket.com
-
ojkae.com
-
netsorrhport.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1560a70e2817b033e408e2b6f01d61f3.exe"C:\Users\Admin\AppData\Local\Temp\1560a70e2817b033e408e2b6f01d61f3.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /fsfs3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1408-18-0x00000000057C0000-0x00000000057D0000-memory.dmp
memory/1408-1-0x0000000000040000-0x00000000000DA000-memory.dmp
memory/1408-2-0x0000000005E00000-0x00000000063A4000-memory.dmp
memory/1408-3-0x0000000005850000-0x00000000058E2000-memory.dmp
memory/1408-4-0x00000000057C0000-0x00000000057D0000-memory.dmp
memory/1408-5-0x0000000005820000-0x000000000582A000-memory.dmp
memory/1408-0-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/1408-17-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/3384-28-0x00000000080A0000-0x0000000008139000-memory.dmp
memory/3384-11-0x0000000007C20000-0x0000000007DA5000-memory.dmp
memory/3384-21-0x0000000007C20000-0x0000000007DA5000-memory.dmp
memory/3384-24-0x00000000080A0000-0x0000000008139000-memory.dmp
memory/3384-25-0x00000000080A0000-0x0000000008139000-memory.dmp
memory/3792-16-0x0000000000730000-0x0000000000759000-memory.dmp
memory/3792-15-0x0000000002A30000-0x0000000002D7A000-memory.dmp
memory/3792-14-0x0000000000730000-0x0000000000759000-memory.dmp
memory/3792-13-0x0000000000E90000-0x0000000000EE7000-memory.dmp
memory/3792-12-0x0000000000E90000-0x0000000000EE7000-memory.dmp
memory/3792-20-0x0000000002720000-0x00000000027B0000-memory.dmp
memory/4916-10-0x0000000001080000-0x0000000001091000-memory.dmp
memory/4916-9-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4916-7-0x00000000010D0000-0x000000000141A000-memory.dmp
memory/4916-6-0x0000000000400000-0x0000000000429000-memory.dmp