Analysis
- max time kernel
90s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
05/02/2024, 06:29
General
- Target 91465509a0f07c2321323ce5c4112f0d.exe
- Size 917KB
- Sample240205-g8y5maefdp
- SHA256 c1f4db9d7274fc25cac02626730a50d14b08f32536e1b4f298c36fb088c622aa
Malware Config
Extracted
-
xloader
-
2.3
-
vtg0
-
time-venture.info
-
salemono.info
-
manzanita.space
-
edxxjjtqma.com
-
mangeshometeam.com
-
shamno.com
-
leanndlescandle.com
-
naukrionlineweb.info
-
8pxdesign.com
-
256897.com
-
mwwa7u95ma757.net
-
premiumnitrileglove.com
-
beachyogastudio.com
-
mibingo.net
-
ibisbudget-oostendeairport.com
-
skype4download.com
-
electricalcfo.com
-
pixelnewsimages.com
-
magetu.info
-
logicprofit.bid
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\91465509a0f07c2321323ce5c4112f0d.exe"C:\Users\Admin\AppData\Local\Temp\91465509a0f07c2321323ce5c4112f0d.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jcYOWJTkYFtTro" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE5FB.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\91465509a0f07c2321323ce5c4112f0d.exe"C:\Users\Admin\AppData\Local\Temp\91465509a0f07c2321323ce5c4112f0d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmpE5FB.tmp
memory/2696-8-0x0000000005050000-0x0000000005062000-memory.dmp
memory/2696-10-0x00000000051C0000-0x00000000051D0000-memory.dmp
memory/2696-3-0x0000000005590000-0x0000000005B34000-memory.dmp
memory/2696-4-0x0000000005080000-0x0000000005112000-memory.dmp
memory/2696-5-0x00000000051C0000-0x00000000051D0000-memory.dmp
memory/2696-7-0x0000000005120000-0x0000000005176000-memory.dmp
memory/2696-6-0x0000000004FC0000-0x0000000004FCA000-memory.dmp
memory/2696-0-0x0000000000450000-0x000000000053A000-memory.dmp
memory/2696-2-0x0000000004EE0000-0x0000000004F7C000-memory.dmp
memory/2696-11-0x0000000007010000-0x00000000070B0000-memory.dmp
memory/2696-9-0x00000000751F0000-0x00000000759A0000-memory.dmp
memory/2696-12-0x0000000002820000-0x0000000002850000-memory.dmp
memory/2696-1-0x00000000751F0000-0x00000000759A0000-memory.dmp
memory/2696-20-0x00000000751F0000-0x00000000759A0000-memory.dmp
memory/4524-18-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4524-21-0x00000000011B0000-0x00000000014FA000-memory.dmp
memory/4524-22-0x00000000011B0000-0x00000000014FA000-memory.dmp