Analysis
- max time kernel
162s - max time network
164s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
05/04/2024, 00:04
General
- Target doc_0862413890.exe
- Size 256KB
- Sample240405-acmy6aec6x
- SHA256 7946718754bb669d3c7a80e355a20047e3e87dbfa9446927ceb6fabab21847d1
Malware Config
Extracted
-
xloader
-
2.5
-
nqn4
-
posadaluna.com
-
ztwl2000.com
-
cvmu.net
-
marvellouslles.com
-
tiromiesu.com
-
allinsqadminn.com
-
8straps.com
-
buyfood.store
-
jipodh.xyz
-
earthsidesoulalchemist.com
-
overiodize.xyz
-
weed.enterprises
-
minuseasy.com
-
konchord.com
-
14attrayanteoffre.com
-
brasbux.com
-
aog.group
-
hairuno.com
-
solheimdesign.com
-
cosmetictreat.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 4 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\doc_0862413890.exe"C:\Users\Admin\AppData\Local\Temp\doc_0862413890.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\doc_0862413890.exe"C:\Users\Admin\AppData\Local\Temp\doc_0862413890.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\doc_0862413890.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
envdl.dll
memory/1848-13-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1848-9-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1848-14-0x00000000006D0000-0x00000000006E1000-memory.dmp
memory/1848-11-0x0000000000BE0000-0x0000000000F2A000-memory.dmp
memory/2600-17-0x0000000000E70000-0x0000000000E97000-memory.dmp
memory/2600-19-0x0000000000E70000-0x0000000000E97000-memory.dmp
memory/2600-20-0x0000000000C00000-0x0000000000C29000-memory.dmp
memory/2600-21-0x0000000002CD0000-0x000000000301A000-memory.dmp
memory/2600-22-0x0000000000C00000-0x0000000000C29000-memory.dmp
memory/2600-24-0x0000000002B00000-0x0000000002B90000-memory.dmp
memory/3488-15-0x0000000007C20000-0x0000000007D64000-memory.dmp
memory/3488-25-0x0000000007C20000-0x0000000007D64000-memory.dmp
memory/3488-28-0x0000000008330000-0x00000000084BC000-memory.dmp
memory/3488-29-0x0000000008330000-0x00000000084BC000-memory.dmp
memory/3488-32-0x0000000008330000-0x00000000084BC000-memory.dmp
memory/4384-10-0x0000000010000000-0x0000000010009000-memory.dmp
memory/4384-6-0x0000000010000000-0x0000000010009000-memory.dmp