Analysis
- max time kernel
142s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
12/02/2024, 23:27
General
- Target 97e418dcc921f79cf45d24a4ea7ad43e.exe
- Size 741KB
- Sample240212-3ftkbsfg77
- SHA256 1afaa72dd3c5654a3291289d3ef7a27e2f2f27e40c24d89ad78efde1cd0fa728
Malware Config
Extracted
-
xloader
-
2.3
-
66op
-
ttxyzp.com
-
miamivendingservices.com
-
namanhphat.com
-
filmexllc.com
-
snowflakebytes.net
-
qygdance.com
-
small-mart.online
-
libryapp.com
-
guadelouperegistry.net
-
hoodiessport.com
-
tienda-china.com
-
musicergonomy.com
-
yahonatinog.space
-
lvn.xyz
-
aerospace-engineers.com
-
bluemountainbeveragecompany.com
-
thedonationcard.com
-
gigharborcancercare.com
-
restondefencejobs.com
-
alfenafootwear.com
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\97e418dcc921f79cf45d24a4ea7ad43e.exe"C:\Users\Admin\AppData\Local\Temp\97e418dcc921f79cf45d24a4ea7ad43e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\97e418dcc921f79cf45d24a4ea7ad43e.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\97e418dcc921f79cf45d24a4ea7ad43e.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/412-10-0x0000000000400000-0x0000000000429000-memory.dmp
memory/412-14-0x00000000013C0000-0x000000000170A000-memory.dmp
memory/412-13-0x00000000013C0000-0x000000000170A000-memory.dmp
memory/1132-6-0x0000000074C20000-0x00000000753D0000-memory.dmp
memory/1132-4-0x0000000005130000-0x00000000051CC000-memory.dmp
memory/1132-5-0x00000000051D0000-0x0000000005262000-memory.dmp
memory/1132-0-0x00000000004A0000-0x000000000055E000-memory.dmp
memory/1132-7-0x0000000004EA0000-0x0000000004EB0000-memory.dmp
memory/1132-8-0x0000000005960000-0x00000000059E4000-memory.dmp
memory/1132-9-0x0000000005700000-0x0000000005732000-memory.dmp
memory/1132-3-0x0000000004F20000-0x0000000004F28000-memory.dmp
memory/1132-12-0x0000000074C20000-0x00000000753D0000-memory.dmp
memory/1132-2-0x0000000004EA0000-0x0000000004EB0000-memory.dmp
memory/1132-1-0x0000000074C20000-0x00000000753D0000-memory.dmp