Analysis
- max time kernel
136s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
05/02/2024, 22:18
General
- Target 932642be9bdf1c8c10912ee4a77353b0.exe
- Size 1.0MB
- Sample240205-18aa2shfh6
- SHA256 32892372ea0ea531841d7df51f2351a46d6c0e1e302fe3cd301407d6acd1ed95
Malware Config
Extracted
-
xloader
-
2.3
-
ftgq
-
naturalbeautyapparel.com
-
abtotalsolution.com
-
periclescapitalmanagement.com
-
pleasejustdont.com
-
ryanscode.com
-
carsandscooters.com
-
best-polarized-sunglasses.com
-
hoodshawaii.com
-
titaefred.com
-
tomrings.com
-
swededenoting.host
-
birthdaytease.com
-
xaydzn.com
-
scutganxun.com
-
gdzhongle.com
-
alossol.com
-
shivamshield.com
-
fashionnailsjohnston.com
-
jobuelas.com
-
arvopaert.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\932642be9bdf1c8c10912ee4a77353b0.exe"C:\Users\Admin\AppData\Local\Temp\932642be9bdf1c8c10912ee4a77353b0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\932642be9bdf1c8c10912ee4a77353b0.exe"C:\Users\Admin\AppData\Local\Temp\932642be9bdf1c8c10912ee4a77353b0.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4180-0-0x00000000747F0000-0x0000000074DA1000-memory.dmp
memory/4180-1-0x00000000747F0000-0x0000000074DA1000-memory.dmp
memory/4180-2-0x00000000012E0000-0x00000000012F0000-memory.dmp
memory/4180-3-0x00000000747F0000-0x0000000074DA1000-memory.dmp
memory/4180-4-0x00000000012E0000-0x00000000012F0000-memory.dmp
memory/4180-8-0x00000000747F0000-0x0000000074DA1000-memory.dmp
memory/4320-5-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4320-7-0x00000000010F0000-0x000000000143A000-memory.dmp