Analysis
-
max time kernel
43s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
08/01/2024, 10:31
General
-
Target
4b32fb4d21ff7225187b42d4c9722dce.exe
-
Size
1.1MB
-
MD5
4b32fb4d21ff7225187b42d4c9722dce
-
SHA1
331e10b03dc5cf994d3985aea2570f08e2707560
-
SHA256
5131b99eca49a0694073f43f58543781fd6adecc63a0cd643a50686b4d3e001a
-
SHA512
d4031c8069d11d78007f215471a982d12ab6059b973477961943dc33d2bf3d0547c95776ebc4b514130964ea9c5e77d2e1b855515c0dea7edf3498e501e2531d
-
SSDEEP
12288:2Gy2V8gP2iNdmth0+QHU6fm5LJHdkhjn+IZjxwRyCVWHz3T/J4GLIh+wT4P:b1yh0+CcFdyjSkCVm/Jql0
Malware Config
Extracted
xloader
2.3
w56m
damai.zone
mywishbookweb.cloud
sandilakeclothing.bid
joysell.net
hackedwhores.com
sjdibang.com
memaquiahiga.com
bleeckerbobs.net
emmettthomas.com
thesheetz.com
mimik33.info
prettyprettybartending.com
3173596.com
shwangjia.com
sightuiop.com
tinnitusnow.online
mahadevexporters.com
cleaninglanarkshire.com
ibiaozhi.net
upinfame.com
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b32fb4d21ff7225187b42d4c9722dce.exe"C:\Users\Admin\AppData\Local\Temp\4b32fb4d21ff7225187b42d4c9722dce.exe"1⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RkaONosqCQHta" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF2FB.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
68KB
-
Filesize
3.3MB
-
Filesize
68KB
-
Filesize
164KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.4MB
-
Filesize
1.6MB
-
Filesize
1.4MB
-
Filesize
1.6MB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
576KB
-
Filesize
3.3MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
640KB
-
Filesize
584KB
-
Filesize
344KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
40KB
-
Filesize
184KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
7.7MB
-
Filesize
5.6MB