Analysis

  • max time kernel
    117s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 19:20

General

  • Target

    495a3851285b29a43693cf5a93516608.exe

  • Size

    1.2MB

  • MD5

    495a3851285b29a43693cf5a93516608

  • SHA1

    7ef194179534a1d0a1a7aa4aacd504c0f6e05853

  • SHA256

    d4dbb398a31310583837a0e3152c739f965ecf44c01e0aacd0249a85630d88be

  • SHA512

    2e7f7849d731f69007f5b80a71b6981c88b110a086ef655b556f59b9f2cc892c453c9b921dc7d9c6646c191737f222c88d5060e0d9d160f57ef1c9f5bbdbd9c3

  • SSDEEP

    24576:xDS/d3BKzksPks2y8jeLELZ7UuyvA1MN7ZNZZ:AKquLEF7UzvbN7ZNZ

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

wufn

Decoy

rsautoluxe.com

theroseofsharonsalon.com

singnema.com

nathanielwhite108.com

theforumonline.com

iqpt.info

joneshondaservice.com

fafene.com

solanohomebuyerclass.com

zwq.xyz

searchlakeconroehomes.com

briative.com

frystmor.city

systemofyouth.com

sctsmney.com

tv-safetrading.com

thesweetboy.com

occulusblu.com

pawsthemomentpetphotography.com

travelstipsguide.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • CustAttr .NET packer 1 IoCs

    Detects CustAttr .NET packer in memory.

  • Xloader payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\495a3851285b29a43693cf5a93516608.exe
    "C:\Users\Admin\AppData\Local\Temp\495a3851285b29a43693cf5a93516608.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\Users\Admin\AppData\Local\Temp\495a3851285b29a43693cf5a93516608.exe
      "C:\Users\Admin\AppData\Local\Temp\495a3851285b29a43693cf5a93516608.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2996

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2084-6-0x0000000005670000-0x000000000570E000-memory.dmp

          Filesize

          632KB

        • memory/2084-7-0x0000000000BA0000-0x0000000000BCE000-memory.dmp

          Filesize

          184KB

        • memory/2084-2-0x0000000004E30000-0x0000000004E70000-memory.dmp

          Filesize

          256KB

        • memory/2084-3-0x0000000000320000-0x0000000000332000-memory.dmp

          Filesize

          72KB

        • memory/2084-4-0x0000000074910000-0x0000000074FFE000-memory.dmp

          Filesize

          6.9MB

        • memory/2084-5-0x0000000004E30000-0x0000000004E70000-memory.dmp

          Filesize

          256KB

        • memory/2084-1-0x0000000074910000-0x0000000074FFE000-memory.dmp

          Filesize

          6.9MB

        • memory/2084-13-0x0000000074910000-0x0000000074FFE000-memory.dmp

          Filesize

          6.9MB

        • memory/2084-0-0x0000000000D20000-0x0000000000E64000-memory.dmp

          Filesize

          1.3MB

        • memory/2996-9-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/2996-8-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/2996-12-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/2996-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2996-14-0x00000000008A0000-0x0000000000BA3000-memory.dmp

          Filesize

          3.0MB

        • memory/2996-15-0x00000000008A0000-0x0000000000BA3000-memory.dmp

          Filesize

          3.0MB