Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11-04-2024 19:04
General
-
Target
IMG_38575943.exe
-
Size
341KB
-
MD5
2a11ef715093c4429cd05dc3950c7f89
-
SHA1
3199e3c72fc349d9cce951c2c8830d88a8da4454
-
SHA256
50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158
-
SHA512
24f2d7a608d421258334144217e97dccdeb023d5e621774f213eda210a8937df0c7d12cfd02e8c96d5951011d6142a320ca3b40bedb8ac6ad5f95ccc6d3d2d0a
-
SSDEEP
6144:HqPwmYdAbc0C3LFDDOQmjUi0GL9jDAlPMKpPbd6j62AeI4KR0VoFtDFF7g:HqPwmYdAbc0CboQmjIGN6Pzd6j6/eWtU
Malware Config
Extracted
xloader
2.5
c6si
tristateinc.construction
americanscaregroundstexas.com
kanimisoshiru.com
wihling.com
fishcheekstosa.com
parentsfuid.com
greenstandmarket.com
fc8fla8kzq.com
gametwist-83.club
jobsncvs.com
directrealtysells.com
avida2015.com
conceptasite.net
arkaneattire.com
indev-mobility.info
2160centurypark412.com
valefloor.com
septembership.com
stackflix.com
jimc0sales.net
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload 4 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 20 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1532-14-0x0000000075360000-0x0000000075B10000-memory.dmpFilesize
7.7MB
-
memory/1532-1-0x0000000075360000-0x0000000075B10000-memory.dmpFilesize
7.7MB
-
memory/1532-2-0x0000000005480000-0x0000000005A24000-memory.dmpFilesize
5.6MB
-
memory/1532-3-0x0000000004ED0000-0x0000000004F62000-memory.dmpFilesize
584KB
-
memory/1532-4-0x0000000005050000-0x0000000005060000-memory.dmpFilesize
64KB
-
memory/1532-5-0x0000000004F90000-0x0000000004F9A000-memory.dmpFilesize
40KB
-
memory/1532-6-0x0000000005270000-0x000000000527C000-memory.dmpFilesize
48KB
-
memory/1532-7-0x00000000065C0000-0x000000000660C000-memory.dmpFilesize
304KB
-
memory/1532-8-0x0000000075360000-0x0000000075B10000-memory.dmpFilesize
7.7MB
-
memory/1532-9-0x0000000005050000-0x0000000005060000-memory.dmpFilesize
64KB
-
memory/1532-10-0x0000000006930000-0x00000000069CC000-memory.dmpFilesize
624KB
-
memory/1532-11-0x0000000006A80000-0x0000000006ADE000-memory.dmpFilesize
376KB
-
memory/1532-0-0x0000000000490000-0x00000000004EC000-memory.dmpFilesize
368KB
-
memory/2424-12-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2424-17-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2424-18-0x0000000000BA0000-0x0000000000BB1000-memory.dmpFilesize
68KB
-
memory/2424-15-0x0000000000EC0000-0x000000000120A000-memory.dmpFilesize
3.3MB
-
memory/3516-28-0x0000000009390000-0x00000000094C0000-memory.dmpFilesize
1.2MB
-
memory/3516-19-0x0000000008D50000-0x0000000008EAD000-memory.dmpFilesize
1.4MB
-
memory/3516-32-0x0000000009390000-0x00000000094C0000-memory.dmpFilesize
1.2MB
-
memory/3516-29-0x0000000009390000-0x00000000094C0000-memory.dmpFilesize
1.2MB
-
memory/4024-23-0x0000000000CD0000-0x0000000000CF9000-memory.dmpFilesize
164KB
-
memory/4024-25-0x0000000000CD0000-0x0000000000CF9000-memory.dmpFilesize
164KB
-
memory/4024-27-0x0000000001690000-0x0000000001720000-memory.dmpFilesize
576KB
-
memory/4024-24-0x0000000001800000-0x0000000001B4A000-memory.dmpFilesize
3.3MB
-
memory/4024-22-0x0000000000070000-0x000000000007E000-memory.dmpFilesize
56KB
-
memory/4024-20-0x0000000000070000-0x000000000007E000-memory.dmpFilesize
56KB