Analysis
- max time kernel
91s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
13/02/2024, 07:52
General
- Target 98e06c036043bbc1dc669ea2f1611c21.exe
- Size 675KB
- Sample240213-jqf77sec53
- SHA256 ca4e8b9f939327da017d8625121beeba12321a66ada9d6c65d21a02d8194f3ca
Malware Config
Extracted
-
xloader
-
2.3
-
t5n8
-
sopheabelle.com
-
brandoncrosss.com
-
oscarpinilla.com
-
nexusbisous.com
-
mmnica.xyz
-
jyomrgw.icu
-
interactivecommons.com
-
aceandarrowboutique.com
-
designtipstricks.com
-
dismerlogistics.com
-
varemodelgulch.com
-
doicard365.com
-
suerickard.com
-
myasovdom.com
-
sulgin.com
-
chadgerman.com
-
valkyrie-teeshirt.com
-
bodycamsforus.com
-
rogueduelisttrade.com
-
suspendthepres.online
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\98e06c036043bbc1dc669ea2f1611c21.exe"C:\Users\Admin\AppData\Local\Temp\98e06c036043bbc1dc669ea2f1611c21.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\98e06c036043bbc1dc669ea2f1611c21.exe"C:\Users\Admin\AppData\Local\Temp\98e06c036043bbc1dc669ea2f1611c21.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\98e06c036043bbc1dc669ea2f1611c21.exe"C:\Users\Admin\AppData\Local\Temp\98e06c036043bbc1dc669ea2f1611c21.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2404-12-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2404-16-0x00000000017F0000-0x0000000001B3A000-memory.dmp
memory/2404-15-0x00000000017F0000-0x0000000001B3A000-memory.dmp
memory/3112-4-0x0000000004F40000-0x0000000004F50000-memory.dmp
memory/3112-0-0x00000000002B0000-0x000000000035E000-memory.dmp
memory/3112-5-0x0000000004D50000-0x0000000004D5A000-memory.dmp
memory/3112-6-0x0000000004EC0000-0x0000000004EDC000-memory.dmp
memory/3112-7-0x0000000006460000-0x00000000064FC000-memory.dmp
memory/3112-8-0x00000000748A0000-0x0000000075050000-memory.dmp
memory/3112-9-0x0000000004F40000-0x0000000004F50000-memory.dmp
memory/3112-10-0x0000000006810000-0x0000000006874000-memory.dmp
memory/3112-11-0x0000000008E20000-0x0000000008E4E000-memory.dmp
memory/3112-3-0x0000000004D90000-0x0000000004E22000-memory.dmp
memory/3112-14-0x00000000748A0000-0x0000000075050000-memory.dmp
memory/3112-2-0x00000000052A0000-0x0000000005844000-memory.dmp
memory/3112-1-0x00000000748A0000-0x0000000075050000-memory.dmp