Analysis
- max time kernel
144s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
12/01/2024, 09:52
General
- Target 5622323af4bbf2a86a3a324270c72077.exe
- Size 739KB
- Sample240112-lweyfaeeb4
- SHA256 a223dffb9765f637f9f9ecdf980573491065b81d188530cee9961931b3ea59b0
Malware Config
Extracted
-
xloader
-
2.3
-
gno4
-
callsecuritymusic.com
-
quikngo.com
-
gardenofbabyclothes.com
-
bailbondinculvercity.com
-
nqyaurlz.icu
-
sultanulhind.com
-
toddy-bodies.com
-
kom-hunter.com
-
theradibio.com
-
pageonefourplay.info
-
wildlifetools.com
-
nobleegoist.com
-
girlsjerkoff.com
-
theenlows.com
-
jyqcxl.com
-
southernbluebee.com
-
betfootballthaigold.com
-
remaxaffinityplus.net
-
teamlunsford.com
-
howtoberealonline.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5622323af4bbf2a86a3a324270c72077.exe"C:\Users\Admin\AppData\Local\Temp\5622323af4bbf2a86a3a324270c72077.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5622323af4bbf2a86a3a324270c72077.exe"C:\Users\Admin\AppData\Local\Temp\5622323af4bbf2a86a3a324270c72077.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\5622323af4bbf2a86a3a324270c72077.exe"C:\Users\Admin\AppData\Local\Temp\5622323af4bbf2a86a3a324270c72077.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1368-8-0x0000000074C20000-0x00000000753D0000-memory.dmp
memory/1368-9-0x0000000005490000-0x00000000054A0000-memory.dmp
memory/1368-3-0x0000000005530000-0x00000000055C2000-memory.dmp
memory/1368-2-0x0000000005AE0000-0x0000000006084000-memory.dmp
memory/1368-4-0x0000000005490000-0x00000000054A0000-memory.dmp
memory/1368-5-0x0000000005500000-0x000000000550A000-memory.dmp
memory/1368-1-0x0000000074C20000-0x00000000753D0000-memory.dmp
memory/1368-6-0x0000000006E30000-0x0000000006ECC000-memory.dmp
memory/1368-0-0x0000000000A40000-0x0000000000AFE000-memory.dmp
memory/1368-7-0x00000000058A0000-0x00000000058BA000-memory.dmp
memory/1368-10-0x0000000006D90000-0x0000000006E2E000-memory.dmp
memory/1368-11-0x0000000009590000-0x00000000095BE000-memory.dmp
memory/1368-14-0x0000000074C20000-0x00000000753D0000-memory.dmp
memory/4948-15-0x0000000001A20000-0x0000000001D6A000-memory.dmp
memory/4948-12-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4948-16-0x0000000001A20000-0x0000000001D6A000-memory.dmp