Analysis
- max time kernel
145s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
01/01/2024, 11:28
General
- Target 3cbb3413f0326aba622bee17f556a293.exe
- Size 1.4MB
- Sample240101-nlcfnscdg3
- SHA256 b7259e9f3050809248c04326cc3af49d4eed3a0bd19c0905b32993a9c219bd3a
Malware Config
Extracted
-
xloader
-
2.3
-
qn6g
-
kemtechonline.com
-
myjourneywithothers.com
-
pfifaq.com
-
vaziva-immo.net
-
thethickpick.com
-
sidvip.com
-
bidaleri.com
-
allginns.com
-
farmersystemofanalysis.com
-
shoponserendipity.com
-
expressdeliverybd.com
-
hargatoyota-malang.com
-
taichiforcalmess.com
-
lovewickcandlecompany.com
-
chrometoasterrv.com
-
chustozen.site
-
xiaofeizhi.com
-
nbzweb.xyz
-
tequenovegano.com
-
e-elearningconsultancy.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cbb3413f0326aba622bee17f556a293.exe"C:\Users\Admin\AppData\Local\Temp\3cbb3413f0326aba622bee17f556a293.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3cbb3413f0326aba622bee17f556a293.exe"C:\Users\Admin\AppData\Local\Temp\3cbb3413f0326aba622bee17f556a293.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3476-8-0x0000000005A00000-0x0000000005A36000-memory.dmp
memory/3476-9-0x00000000746A0000-0x0000000074E50000-memory.dmp
memory/3476-2-0x0000000007E00000-0x0000000007E9C000-memory.dmp
memory/3476-3-0x0000000008450000-0x00000000089F4000-memory.dmp
memory/3476-4-0x0000000007EA0000-0x0000000007F32000-memory.dmp
memory/3476-5-0x0000000008070000-0x0000000008080000-memory.dmp
memory/3476-7-0x0000000008080000-0x00000000080D6000-memory.dmp
memory/3476-6-0x0000000003250000-0x000000000325A000-memory.dmp
memory/3476-0-0x0000000000DA0000-0x0000000000F16000-memory.dmp
memory/3476-10-0x0000000008070000-0x0000000008080000-memory.dmp
memory/3476-1-0x00000000746A0000-0x0000000074E50000-memory.dmp
memory/3476-11-0x0000000001660000-0x00000000016D8000-memory.dmp
memory/3476-15-0x00000000746A0000-0x0000000074E50000-memory.dmp
memory/3476-12-0x00000000017E0000-0x0000000001810000-memory.dmp
memory/4340-16-0x00000000012F0000-0x000000000163A000-memory.dmp
memory/4340-13-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4340-17-0x00000000012F0000-0x000000000163A000-memory.dmp