Analysis
- max time kernel
142s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/02/2024, 16:39
General
- Target a9a4ef232a3238c20d7e392ca286c265.exe
- Size 730KB
- Sample240227-t6c6laeb76
- SHA256 3613eae18cceb9fd6e149a66ef37260b6e57a471e8192aa1d40754399d143f9b
Malware Config
Extracted
-
xloader
-
2.3
-
sqwo
-
socialbutterfliesny.com
-
communityalliances.info
-
buddyislesauto.com
-
redhatsnow.net
-
trythryv.net
-
accountupdateonline.net
-
fourseasonsbaby.com
-
ratarate.com
-
ucretsizbilgiler.com
-
joyfrantzis.com
-
cr-computers.com
-
xinfengsl.com
-
reddiir.com
-
boealive.com
-
dorfakoil.com
-
apexexprtwaterfilters.com
-
karsa4d.com
-
dabanse.com
-
redeobvilion.com
-
hisct.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9a4ef232a3238c20d7e392ca286c265.exe"C:\Users\Admin\AppData\Local\Temp\a9a4ef232a3238c20d7e392ca286c265.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a9a4ef232a3238c20d7e392ca286c265.exe"C:\Users\Admin\AppData\Local\Temp\a9a4ef232a3238c20d7e392ca286c265.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a9a4ef232a3238c20d7e392ca286c265.exe"C:\Users\Admin\AppData\Local\Temp\a9a4ef232a3238c20d7e392ca286c265.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2628 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3224-12-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3224-15-0x00000000012F0000-0x000000000163A000-memory.dmp
memory/3876-6-0x0000000004D10000-0x0000000004D2C000-memory.dmp
memory/3876-3-0x0000000004B80000-0x0000000004C12000-memory.dmp
memory/3876-4-0x0000000004D90000-0x0000000004DA0000-memory.dmp
memory/3876-5-0x0000000004C30000-0x0000000004C3A000-memory.dmp
memory/3876-0-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/3876-7-0x0000000006250000-0x00000000062EC000-memory.dmp
memory/3876-8-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/3876-9-0x0000000004D90000-0x0000000004DA0000-memory.dmp
memory/3876-10-0x0000000006360000-0x00000000063CE000-memory.dmp
memory/3876-11-0x0000000008910000-0x0000000008946000-memory.dmp
memory/3876-2-0x0000000005130000-0x00000000056D4000-memory.dmp
memory/3876-14-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/3876-1-0x00000000000C0000-0x000000000017C000-memory.dmp