Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25-01-2024 06:20
General
-
Target
73f4257033c590c868506ed0a0aa7a29.exe
-
Size
1.6MB
-
MD5
73f4257033c590c868506ed0a0aa7a29
-
SHA1
bf288989eec6aa6a6f4bb2696d189d08d268e0db
-
SHA256
cbe7c0318d2f88aff2f18fc19a824bfdebcf2f7137d85adac1a5799afbb6876b
-
SHA512
27021063a83959f39d7f4138055fff4910fe692e97d86f0f5c7259d5013ebbc7e9025b84f9418225df98aee5da54a0abf0446c30487b2b5c6107c9eb2b562392
-
SSDEEP
24576:/IcLW5oaXpcB7mVSaccPuvcd5OGQT/1/0nS+7n4SYwqK4zf3RTsAHWAgqChJ+hul:wLiecj1a/TEuNQuiNB/e
Malware Config
Extracted
xloader
2.3
ipa8
royalposhpups.com
univa.world
lanerbo.com
shopbabygo.com
theutahhomestore.com
serialmixer.icu
linfeiya.com
xn--12cg3de5c2eb5cyi.com
am-conseil-communication.com
dailygame168.com
therightmilitia.com
visions-agency.com
mapopi.com
frugallyketo.com
guapandglo.com
54w-x126v.net
your-health-kick.com
blockchainhub360.com
registernowhd.xyz
votekellykitashima.com
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\73f4257033c590c868506ed0a0aa7a29.exe"C:\Users\Admin\AppData\Local\Temp\73f4257033c590c868506ed0a0aa7a29.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\73f4257033c590c868506ed0a0aa7a29.exe"C:\Users\Admin\AppData\Local\Temp\73f4257033c590c868506ed0a0aa7a29.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1664-8-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1664-16-0x00000000008B0000-0x0000000000BB3000-memory.dmpFilesize
3.0MB
-
memory/1664-14-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1664-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1664-10-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2024-3-0x0000000000340000-0x0000000000376000-memory.dmpFilesize
216KB
-
memory/2024-6-0x0000000004D80000-0x0000000004DF8000-memory.dmpFilesize
480KB
-
memory/2024-7-0x00000000004F0000-0x0000000000520000-memory.dmpFilesize
192KB
-
memory/2024-5-0x0000000004E80000-0x0000000004EC0000-memory.dmpFilesize
256KB
-
memory/2024-4-0x0000000074870000-0x0000000074F5E000-memory.dmpFilesize
6.9MB
-
memory/2024-1-0x0000000074870000-0x0000000074F5E000-memory.dmpFilesize
6.9MB
-
memory/2024-2-0x0000000004E80000-0x0000000004EC0000-memory.dmpFilesize
256KB
-
memory/2024-15-0x0000000074870000-0x0000000074F5E000-memory.dmpFilesize
6.9MB
-
memory/2024-0-0x0000000000C00000-0x0000000000D94000-memory.dmpFilesize
1.6MB