Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
16-03-2024 22:26
General
-
Target
cf3a28df3cd2682651ced75c40b06155.exe
-
Size
245KB
-
MD5
cf3a28df3cd2682651ced75c40b06155
-
SHA1
df85d8f256b8fd779d660f633eca94a7ea6c3cea
-
SHA256
3357b4a89dc623781355fe7a673329975777b2a5ce8a2051c538dcb7d4969c8e
-
SHA512
89c8d75516d889c8993abe926ddf5713e4fe207d459dafffa01d90df01e7f7fea63ffa0ca7428d15b0940f01c9290706c776b0b2461e160cebe2eb23a097b3b5
-
SSDEEP
6144:Na/djfLqZHNlXeQN/TezMUpyXVG71CRdzf:XfnNQpB8zf
Malware Config
Extracted
xloader
2.3
b6a4
reviewsresolutions.com
binhminhgardenshophouse.com
nebulacom.com
kadhambaristudio.com
viltoom.club
supmomma.com
tjszxddc.com
darlingmemories.com
hyperultrapure.com
vibembrio.com
reallycoolmask.com
cumbukita.com
brian-newby.com
abstractaccessories.com
marykinky.com
minnesotareversemtgloans.com
prasetlement.com
xplpgi.com
xn--gdask-y7a.com
uababaseball.com
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload 4 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cf3a28df3cd2682651ced75c40b06155.exe"C:\Users\Admin\AppData\Local\Temp\cf3a28df3cd2682651ced75c40b06155.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\cf3a28df3cd2682651ced75c40b06155.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\svchost.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1300-1-0x00000000000A0000-0x00000000001A0000-memory.dmpFilesize
1024KB
-
memory/1300-2-0x00000000004B0000-0x00000000004B2000-memory.dmpFilesize
8KB
-
memory/2004-16-0x0000000002DD0000-0x0000000002E5F000-memory.dmpFilesize
572KB
-
memory/2004-11-0x00000000008C0000-0x0000000000CF3000-memory.dmpFilesize
4.2MB
-
memory/2004-14-0x0000000001000000-0x0000000001028000-memory.dmpFilesize
160KB
-
memory/2004-13-0x00000000030A0000-0x00000000033EA000-memory.dmpFilesize
3.3MB
-
memory/2004-12-0x0000000001000000-0x0000000001028000-memory.dmpFilesize
160KB
-
memory/2004-9-0x00000000008C0000-0x0000000000CF3000-memory.dmpFilesize
4.2MB
-
memory/2028-3-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2028-7-0x0000000001670000-0x0000000001680000-memory.dmpFilesize
64KB
-
memory/2028-6-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2028-4-0x0000000001700000-0x0000000001A4A000-memory.dmpFilesize
3.3MB
-
memory/3444-8-0x0000000008D10000-0x0000000008EA6000-memory.dmpFilesize
1.6MB
-
memory/3444-17-0x0000000008D10000-0x0000000008EA6000-memory.dmpFilesize
1.6MB
-
memory/3444-19-0x000000000A9C0000-0x000000000AB40000-memory.dmpFilesize
1.5MB
-
memory/3444-21-0x000000000A9C0000-0x000000000AB40000-memory.dmpFilesize
1.5MB
-
memory/3444-24-0x000000000A9C0000-0x000000000AB40000-memory.dmpFilesize
1.5MB