Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
05/03/2024, 17:56
General
- Target b54e7fb4262c31a414b6dbcb49a5d800.exe
- Size 718KB
- Sample240305-wh7fmsdh98
- SHA256 6c282c90bf6e72212f3c2038601a503d9e9e36bb417687fc8b16362fe854fa3d
Malware Config
Extracted
-
xloader
-
2.3
-
q4kr
-
realmodapk.com
-
hanoharuka.com
-
shivalikspiritualproducts.com
-
womenshealthclinincagra.com
-
racketpark.com
-
startuporig.com
-
azkachinas.com
-
klanblog.com
-
linuxradio.tools
-
siteoficial-liquida.com
-
glsbuyer.com
-
bestdeez.com
-
teens2cash.com
-
valleyviewconstruct.com
-
myfortniteskins.com
-
cambecare.com
-
csec2011.com
-
idookap.com
-
warmwallsrecords.com
-
smartmirror.one
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b54e7fb4262c31a414b6dbcb49a5d800.exe"C:\Users\Admin\AppData\Local\Temp\b54e7fb4262c31a414b6dbcb49a5d800.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2260,i,3303482231723870786,2954015409682154873,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1764-12-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1764-17-0x0000000000BE0000-0x0000000000BF0000-memory.dmp
memory/1764-16-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1764-14-0x00000000014C0000-0x000000000180A000-memory.dmp
memory/2388-6-0x0000000005710000-0x0000000005718000-memory.dmp
memory/2388-19-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/2388-0-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/2388-7-0x00000000066B0000-0x000000000674C000-memory.dmp
memory/2388-8-0x0000000074640000-0x0000000074DF0000-memory.dmp
memory/2388-9-0x0000000005670000-0x0000000005680000-memory.dmp
memory/2388-10-0x0000000008230000-0x00000000082EE000-memory.dmp
memory/2388-11-0x00000000081B0000-0x000000000821C000-memory.dmp
memory/2388-4-0x0000000005670000-0x0000000005680000-memory.dmp
memory/2388-3-0x0000000005450000-0x00000000054E2000-memory.dmp
memory/2388-2-0x0000000005B00000-0x00000000060A4000-memory.dmp
memory/2388-5-0x0000000005510000-0x000000000551A000-memory.dmp
memory/2388-1-0x00000000009C0000-0x0000000000A7A000-memory.dmp
memory/3528-18-0x00000000090B0000-0x0000000009227000-memory.dmp
memory/3528-30-0x00000000034D0000-0x00000000035BC000-memory.dmp
memory/3528-31-0x00000000034D0000-0x00000000035BC000-memory.dmp
memory/3528-35-0x00000000034D0000-0x00000000035BC000-memory.dmp
memory/4040-20-0x0000000000B80000-0x0000000000B94000-memory.dmp
memory/4040-22-0x0000000000B80000-0x0000000000B94000-memory.dmp
memory/4040-23-0x00000000008B0000-0x00000000008D9000-memory.dmp
memory/4040-24-0x0000000002850000-0x0000000002B9A000-memory.dmp
memory/4040-25-0x00000000008B0000-0x00000000008D9000-memory.dmp
memory/4040-27-0x00000000025F0000-0x000000000267F000-memory.dmp