Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-04-2024 05:06

General

  • Target

    $PLUGINSDIR/envdl.dll

  • Size

    21KB

  • MD5

    4a7f4f8dddc69b711134773bc01482c5

  • SHA1

    7c3e00bfff4bcfaf2ccdce971cd247f7be3cdb0f

  • SHA256

    d12d71c87dbbe93303a1402e368e5e8827d512aa54bae78347077ca468abdbc6

  • SHA512

    19548dd1400535a606c1d6d82f7b9e6c41ecfedbeed269c7e62009f60fff12a96a24c837e8332e31d529b0a81e09e1ac470c1b7b500cc39fccae23cae12b8e2a

  • SSDEEP

    384:jnM0lcYC8SkzLuFhmRWxENbU1UpqrT5JHrqH+OC:jM0+YfSkzLuFjIwW6nHrd

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

nqn4

Decoy

posadaluna.com

ztwl2000.com

cvmu.net

marvellouslles.com

tiromiesu.com

allinsqadminn.com

8straps.com

buyfood.store

jipodh.xyz

earthsidesoulalchemist.com

overiodize.xyz

weed.enterprises

minuseasy.com

konchord.com

14attrayanteoffre.com

brasbux.com

aog.group

hairuno.com

solheimdesign.com

cosmetictreat.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3420
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\envdl.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1124
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\envdl.dll,#1
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4532
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\envdl.dll,#1
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2360
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5092
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\rundll32.exe"
        3⤵
          PID:448

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2360-1-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

    • memory/2360-3-0x0000000002BE0000-0x0000000002F2A000-memory.dmp

      Filesize

      3.3MB

    • memory/2360-5-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

    • memory/2360-6-0x0000000000F90000-0x0000000000FA1000-memory.dmp

      Filesize

      68KB

    • memory/3420-16-0x00000000087F0000-0x0000000008937000-memory.dmp

      Filesize

      1.3MB

    • memory/3420-7-0x00000000087F0000-0x0000000008937000-memory.dmp

      Filesize

      1.3MB

    • memory/3420-23-0x0000000008A70000-0x0000000008BB6000-memory.dmp

      Filesize

      1.3MB

    • memory/3420-20-0x0000000008A70000-0x0000000008BB6000-memory.dmp

      Filesize

      1.3MB

    • memory/3420-19-0x0000000008A70000-0x0000000008BB6000-memory.dmp

      Filesize

      1.3MB

    • memory/4532-2-0x0000000010000000-0x0000000010009000-memory.dmp

      Filesize

      36KB

    • memory/4532-0-0x0000000010000000-0x0000000010009000-memory.dmp

      Filesize

      36KB

    • memory/5092-10-0x0000000000EA0000-0x0000000000EB4000-memory.dmp

      Filesize

      80KB

    • memory/5092-15-0x0000000002460000-0x00000000024F0000-memory.dmp

      Filesize

      576KB

    • memory/5092-13-0x00000000006B0000-0x00000000006D9000-memory.dmp

      Filesize

      164KB

    • memory/5092-12-0x00000000027C0000-0x0000000002B0A000-memory.dmp

      Filesize

      3.3MB

    • memory/5092-11-0x00000000006B0000-0x00000000006D9000-memory.dmp

      Filesize

      164KB

    • memory/5092-8-0x0000000000EA0000-0x0000000000EB4000-memory.dmp

      Filesize

      80KB