Analysis
- max time kernel
144s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
28/01/2024, 07:41
General
- Target 7c8a7c1060d52a455e3e47699c536cc0.exe
- Size 762KB
- Sample240128-jh321aecc5
- SHA256 7c448dd47ac93f7ae852e78a256270ea7733d873fef8395d782364fd65c3032e
Malware Config
Extracted
-
xloader
-
2.3
-
nwru
-
zjkhyo.com
-
mogreener.com
-
galanpresente.com
-
anthologistliving.com
-
jfl-info.net
-
cascobaycuttlerly.com
-
nefertityeg.com
-
greatescapefurniture.com
-
primulashop.com
-
xn--cittinrete-k4a.com
-
drugstoire.com
-
kefaloniabride.com
-
viralgenstudents.com
-
makerwl.com
-
rubyweed.com
-
badenio.com
-
smartcontracttraders.com
-
lcscards-veilig.icu
-
qf553.com
-
dnhsxm.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c8a7c1060d52a455e3e47699c536cc0.exe"C:\Users\Admin\AppData\Local\Temp\7c8a7c1060d52a455e3e47699c536cc0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7c8a7c1060d52a455e3e47699c536cc0.exe"C:\Users\Admin\AppData\Local\Temp\7c8a7c1060d52a455e3e47699c536cc0.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/452-15-0x0000000000400000-0x0000000000428000-memory.dmp
memory/452-19-0x0000000001950000-0x0000000001C9A000-memory.dmp
memory/452-18-0x0000000001950000-0x0000000001C9A000-memory.dmp
memory/2176-7-0x00000000068D0000-0x0000000006936000-memory.dmp
memory/2176-10-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/2176-5-0x0000000005400000-0x0000000005410000-memory.dmp
memory/2176-6-0x0000000006810000-0x0000000006838000-memory.dmp
memory/2176-8-0x00000000068A0000-0x00000000068C2000-memory.dmp
memory/2176-1-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/2176-9-0x0000000005400000-0x0000000005410000-memory.dmp
memory/2176-2-0x0000000005650000-0x0000000005BF4000-memory.dmp
memory/2176-11-0x0000000005400000-0x0000000005410000-memory.dmp
memory/2176-12-0x0000000005400000-0x0000000005410000-memory.dmp
memory/2176-13-0x0000000007040000-0x0000000007054000-memory.dmp
memory/2176-14-0x0000000007190000-0x0000000007196000-memory.dmp
memory/2176-4-0x00000000051E0000-0x000000000527C000-memory.dmp
memory/2176-17-0x00000000746D0000-0x0000000074E80000-memory.dmp
memory/2176-3-0x00000000050A0000-0x0000000005132000-memory.dmp
memory/2176-0-0x00000000005E0000-0x00000000006A4000-memory.dmp