Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
08/03/2024, 02:00
General
- Target ba3c72780f80542fe09aeed80a9a56c6.exe
- Size 489KB
- Sample240308-ce2w7sdc7t
- SHA256 c840ee368fcab5974485c16fc456b1dc1923cc5e113ce6a96f6f314a7ec5ac94
Malware Config
Extracted
-
xloader
-
2.3
-
t75f
-
onegolfsydney.com
-
kaizensportscoaching.com
-
mliacbjv.icu
-
rinstech.net
-
midas-parts.com
-
istmenian.com
-
ibrahimpike.com
-
herbspaces.com
-
gentleman4higher.com
-
workabusiness.com
-
isabusive.website
-
222555dy.com
-
lwhyzhzb.xyz
-
gabrielabravoillanes.com
-
hearthomelife.com
-
buildswealth.com
-
printitaz.com
-
l-mventures.com
-
baincot3.com
-
nstaq-labs.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 4 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 51 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ba3c72780f80542fe09aeed80a9a56c6.exe"C:\Users\Admin\AppData\Local\Temp\ba3c72780f80542fe09aeed80a9a56c6.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1136-8-0x0000000075000000-0x00000000757B0000-memory.dmp
memory/1136-10-0x000000000B550000-0x000000000B5B4000-memory.dmp
memory/1136-2-0x0000000005330000-0x00000000058D4000-memory.dmp
memory/1136-3-0x0000000004C70000-0x0000000004D02000-memory.dmp
memory/1136-4-0x0000000004F50000-0x0000000004F60000-memory.dmp
memory/1136-5-0x0000000004D30000-0x0000000004D3A000-memory.dmp
memory/1136-6-0x0000000005260000-0x000000000527C000-memory.dmp
memory/1136-7-0x000000000B480000-0x000000000B51C000-memory.dmp
memory/1136-1-0x0000000000220000-0x00000000002A0000-memory.dmp
memory/1136-0-0x0000000075000000-0x00000000757B0000-memory.dmp
memory/1136-9-0x0000000004F50000-0x0000000004F60000-memory.dmp
memory/1136-11-0x000000000DF90000-0x000000000DFBE000-memory.dmp
memory/1136-14-0x0000000075000000-0x00000000757B0000-memory.dmp
memory/3456-34-0x0000000008D70000-0x0000000008E7E000-memory.dmp
memory/3456-31-0x0000000008D70000-0x0000000008E7E000-memory.dmp
memory/3456-30-0x0000000008D70000-0x0000000008E7E000-memory.dmp
memory/3456-27-0x00000000092D0000-0x000000000944B000-memory.dmp
memory/3456-19-0x00000000092D0000-0x000000000944B000-memory.dmp
memory/3940-23-0x0000000001120000-0x000000000146A000-memory.dmp
memory/3940-21-0x00000000006A0000-0x00000000006A7000-memory.dmp
memory/3940-22-0x0000000000780000-0x00000000007A9000-memory.dmp
memory/3940-20-0x00000000006A0000-0x00000000006A7000-memory.dmp
memory/3940-24-0x0000000000780000-0x00000000007A9000-memory.dmp
memory/3940-26-0x0000000000EC0000-0x0000000000F4F000-memory.dmp
memory/4360-18-0x00000000005F0000-0x0000000000600000-memory.dmp
memory/4360-17-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4360-15-0x0000000000ED0000-0x000000000121A000-memory.dmp
memory/4360-12-0x0000000000400000-0x0000000000429000-memory.dmp