Analysis
- max time kernel
136s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
26/01/2024, 04:03
General
- Target 7655c98f48523e3193b9ac89d75fbe38.exe
- Size 722KB
- Sample240126-ems1dadgc5
- SHA256 44d847dab28126b7770dfe3119d64bccc226a86f59d964de2516f9fe08cc18db
Malware Config
Extracted
-
xloader
-
2.3
-
bbd3
-
academianeurosapiens.com
-
dracaenaclub.com
-
goodshoup.com
-
ubkpay2020.xyz
-
desireinspiration.com
-
saiglobals.com
-
inspire-coworks.com
-
bidmotorsleiloes.com
-
fk-taiyo.com
-
krossspace.com
-
qualityda.site
-
compresedairsystems.com
-
hvacwebdesigner.com
-
lascapsystems.com
-
7434west114th.info
-
christajaillethomes.com
-
ms00852.com
-
aliceinhome.com
-
eer.xyz
-
eritreamatrimony.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7655c98f48523e3193b9ac89d75fbe38.exe"C:\Users\Admin\AppData\Local\Temp\7655c98f48523e3193b9ac89d75fbe38.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7655c98f48523e3193b9ac89d75fbe38.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3528-0-0x00000000009B0000-0x0000000000A6A000-memory.dmp
memory/3528-1-0x0000000074870000-0x0000000075020000-memory.dmp
memory/3528-2-0x0000000005A70000-0x0000000006014000-memory.dmp
memory/3528-3-0x0000000005560000-0x00000000055F2000-memory.dmp
memory/3528-4-0x00000000056F0000-0x0000000005700000-memory.dmp
memory/3528-5-0x0000000005470000-0x000000000547A000-memory.dmp
memory/3528-6-0x0000000005550000-0x0000000005558000-memory.dmp
memory/3528-7-0x00000000067C0000-0x000000000685C000-memory.dmp
memory/3528-8-0x0000000074870000-0x0000000075020000-memory.dmp
memory/3528-9-0x00000000056F0000-0x0000000005700000-memory.dmp
memory/3528-10-0x0000000007F80000-0x0000000008000000-memory.dmp
memory/3528-11-0x000000000A670000-0x000000000A6A0000-memory.dmp
memory/3528-14-0x0000000074870000-0x0000000075020000-memory.dmp
memory/4508-15-0x0000000001830000-0x0000000001B7A000-memory.dmp
memory/4508-12-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4508-16-0x0000000001830000-0x0000000001B7A000-memory.dmp