Analysis
- max time kernel
133s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
03/02/2024, 21:29
General
- Target 8d64d8013120117fa5492fee6ae6fac7.exe
- Size 689KB
- Sample240203-1cekwsaeh2
- SHA256 3ee48107ac387473d863aab9953de3b92cbffc8a6df8e93e628d77afbffd9a28
Malware Config
Extracted
-
xloader
-
2.3
-
di4r
-
live360healthplan.com
-
thesloanecollective.com
-
nextlevelketones.co.uk
-
tckmingle.com
-
tomeofcookery.com
-
peopleskillscoaching.com
-
flairinvent.com
-
theskinnytype.com
-
robotikfulfillment.com
-
noveltyhappens.com
-
ccf123.com
-
arcadems.com
-
sbacupuncturecenter.com
-
rsgt.team
-
guardianlofts.com
-
thesmilingzebra.com
-
wzditai.com
-
bettina-greco.com
-
holoholobiyori.info
-
hisaryusample.xyz
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d64d8013120117fa5492fee6ae6fac7.exe"C:\Users\Admin\AppData\Local\Temp\8d64d8013120117fa5492fee6ae6fac7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8d64d8013120117fa5492fee6ae6fac7.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1984-13-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1984-14-0x00000000013C0000-0x000000000170A000-memory.dmp
memory/3904-8-0x0000000007810000-0x00000000078AC000-memory.dmp
memory/3904-9-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/3904-4-0x00000000059B0000-0x0000000005A42000-memory.dmp
memory/3904-5-0x0000000005900000-0x0000000005910000-memory.dmp
memory/3904-6-0x0000000005950000-0x000000000595A000-memory.dmp
memory/3904-7-0x0000000005AC0000-0x0000000005AC8000-memory.dmp
memory/3904-0-0x00000000748B0000-0x0000000075060000-memory.dmp
memory/3904-3-0x000000000A110000-0x000000000A6B4000-memory.dmp
memory/3904-10-0x0000000005900000-0x0000000005910000-memory.dmp
memory/3904-11-0x0000000007ED0000-0x0000000007F52000-memory.dmp
memory/3904-12-0x00000000056B0000-0x00000000056E0000-memory.dmp
memory/3904-2-0x0000000005890000-0x00000000058EC000-memory.dmp
memory/3904-1-0x0000000000C40000-0x0000000000CF2000-memory.dmp
memory/3904-16-0x00000000748B0000-0x0000000075060000-memory.dmp