Analysis
- max time kernel
147s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
- submitted
26/02/2024, 13:21
General
- Target a6741569fb8c3933437aeaba878edc79.exe
- Size 592KB
- Sample240226-qls5jaef27
- SHA256 495c9c1a0e1493e1a043a9dec928df1a3e0f3c170ce695a98ca8c8ae173ddf5c
Malware Config
Extracted
-
xloader
-
2.3
-
vc20
-
222gu7com-888888gu7app.com
-
richb.online
-
lindaplusch.com
-
polarisjunctionapts.com
-
vrolin.com
-
duncanvillebouncehouse.com
-
coldnationmusic.com
-
afamegagt.com
-
mariospizzanewark.com
-
jinggouwg.com
-
yourandromeda-es.com
-
fanuron.com
-
bestv.xyz
-
palhh.com
-
pcsoftwaresdownload.com
-
courseyblvd.com
-
jupiterpcrepair.com
-
tmtiket.com
-
ojkae.com
-
netsorrhport.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6741569fb8c3933437aeaba878edc79.exe"C:\Users\Admin\AppData\Local\Temp\a6741569fb8c3933437aeaba878edc79.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /fsfs2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 1843⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4836 -ip 48361⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/928-1-0x00000000751E0000-0x0000000075990000-memory.dmp
memory/928-0-0x0000000000160000-0x00000000001FA000-memory.dmp
memory/928-2-0x0000000005FA0000-0x0000000006544000-memory.dmp
memory/928-3-0x0000000005890000-0x0000000005922000-memory.dmp
memory/928-4-0x00000000059E0000-0x00000000059F0000-memory.dmp
memory/928-5-0x00000000059D0000-0x00000000059DA000-memory.dmp
memory/928-9-0x00000000751E0000-0x0000000075990000-memory.dmp
memory/928-10-0x00000000059E0000-0x00000000059F0000-memory.dmp
memory/4836-7-0x0000000000580000-0x00000000005A9000-memory.dmp