Analysis
- max time kernel
92s - max time network
120s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
28/01/2024, 09:13
General
- Target 7cbac1947d5001c89afeb6fb85bc700f.exe
- Size 1.1MB
- Sample240128-k64twaffe9
- SHA256 447a46290b25b635d7ebfa84c071700e304ce1a7b6b79068aa413c95e0ec98ad
Malware Config
Extracted
-
xloader
-
2.3
-
p4se
-
weightlossforprofessionals.com
-
talkotstopandshop.com
-
everesttechsolutions.com
-
garboarts.com
-
esubastas-online.com
-
electriclastmile.com
-
tomio.tech
-
jacoty.com
-
knot-tied-up.com
-
energychoicesim.com
-
rocketcompaniessham.com
-
madarasapattinam.com
-
promosplace.com
-
newstarchurch.com
-
thesaleskitchen.com
-
slingmodeinc.com
-
jobresulthub.com
-
pillclk.com
-
shipu119.com
-
sibalcar.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cbac1947d5001c89afeb6fb85bc700f.exe"C:\Users\Admin\AppData\Local\Temp\7cbac1947d5001c89afeb6fb85bc700f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7cbac1947d5001c89afeb6fb85bc700f.exe"C:\Users\Admin\AppData\Local\Temp\7cbac1947d5001c89afeb6fb85bc700f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/960-12-0x0000000000400000-0x0000000000429000-memory.dmp
memory/960-16-0x00000000017A0000-0x0000000001AEA000-memory.dmp
memory/960-15-0x00000000017A0000-0x0000000001AEA000-memory.dmp
memory/4924-4-0x0000000004F50000-0x0000000004FEC000-memory.dmp
memory/4924-1-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/4924-5-0x0000000004F10000-0x0000000004F20000-memory.dmp
memory/4924-6-0x0000000004EB0000-0x0000000004EBA000-memory.dmp
memory/4924-7-0x0000000006EA0000-0x0000000006EBA000-memory.dmp
memory/4924-8-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/4924-9-0x0000000004F10000-0x0000000004F20000-memory.dmp
memory/4924-10-0x00000000079B0000-0x0000000007A4E000-memory.dmp
memory/4924-11-0x000000000B130000-0x000000000B160000-memory.dmp
memory/4924-3-0x0000000004E10000-0x0000000004EA2000-memory.dmp
memory/4924-14-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/4924-2-0x00000000052E0000-0x0000000005884000-memory.dmp
memory/4924-0-0x0000000000300000-0x0000000000420000-memory.dmp