Analysis
- max time kernel
144s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
13/02/2024, 05:45
General
- Target 989ffa65964d3923c76d6d23088f1171.exe
- Size 980KB
- Sample240213-gf2eaage9s
- SHA256 cff2b230a7ac1b41f748b4ea56bc46657f57665790f0de9813786a8d2fe893b6
Malware Config
Extracted
-
xloader
-
2.3
-
hisp
-
securityandtrust.com
-
chalk-and-slate.com
-
0sinwt.com
-
stpetecustomyardgreetings.com
-
atrangii.com
-
cheil2001.com
-
ubernet.network
-
throwbackreport.com
-
piramidium.com
-
leclarksgrocery.com
-
bwzzw.com
-
lapizza.express
-
shopashro.com
-
bulukx.com
-
enanobanco.com
-
goodhealthtw.com
-
realtyadvisorscoaching.com
-
czchenhui.com
-
xn--fjqusn87csg7b.com
-
womeninrefrigeration.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\989ffa65964d3923c76d6d23088f1171.exe"C:\Users\Admin\AppData\Local\Temp\989ffa65964d3923c76d6d23088f1171.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\989ffa65964d3923c76d6d23088f1171.exe"C:\Users\Admin\AppData\Local\Temp\989ffa65964d3923c76d6d23088f1171.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3192-13-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3192-17-0x0000000001320000-0x000000000166A000-memory.dmp
memory/3192-16-0x0000000001320000-0x000000000166A000-memory.dmp
memory/4448-8-0x0000000005D10000-0x0000000005D28000-memory.dmp
memory/4448-10-0x0000000005910000-0x0000000005920000-memory.dmp
memory/4448-5-0x0000000005910000-0x0000000005920000-memory.dmp
memory/4448-7-0x0000000005A80000-0x0000000005AD6000-memory.dmp
memory/4448-6-0x0000000005A00000-0x0000000005A0A000-memory.dmp
memory/4448-1-0x0000000074940000-0x00000000750F0000-memory.dmp
memory/4448-9-0x0000000074940000-0x00000000750F0000-memory.dmp
memory/4448-3-0x0000000006030000-0x00000000065D4000-memory.dmp
memory/4448-11-0x0000000008910000-0x00000000089C0000-memory.dmp
memory/4448-12-0x000000000B090000-0x000000000B0D0000-memory.dmp
memory/4448-4-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/4448-15-0x0000000074940000-0x00000000750F0000-memory.dmp
memory/4448-0-0x0000000000E70000-0x0000000000F6C000-memory.dmp
memory/4448-2-0x0000000005950000-0x00000000059EC000-memory.dmp