Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
15-04-2024 21:55
General
-
Target
IMG_38575943.exe
-
Size
341KB
-
MD5
2a11ef715093c4429cd05dc3950c7f89
-
SHA1
3199e3c72fc349d9cce951c2c8830d88a8da4454
-
SHA256
50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158
-
SHA512
24f2d7a608d421258334144217e97dccdeb023d5e621774f213eda210a8937df0c7d12cfd02e8c96d5951011d6142a320ca3b40bedb8ac6ad5f95ccc6d3d2d0a
-
SSDEEP
6144:HqPwmYdAbc0C3LFDDOQmjUi0GL9jDAlPMKpPbd6j62AeI4KR0VoFtDFF7g:HqPwmYdAbc0CboQmjIGN6Pzd6j6/eWtU
Score
10/10
Malware Config
Extracted
Family
xloader
Version
2.5
Campaign
c6si
Decoy
tristateinc.construction
americanscaregroundstexas.com
kanimisoshiru.com
wihling.com
fishcheekstosa.com
parentsfuid.com
greenstandmarket.com
fc8fla8kzq.com
gametwist-83.club
jobsncvs.com
directrealtysells.com
avida2015.com
conceptasite.net
arkaneattire.com
indev-mobility.info
2160centurypark412.com
valefloor.com
septembership.com
stackflix.com
jimc0sales.net
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader payload 4 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 50 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"3⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2364-12-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2364-18-0x0000000001360000-0x0000000001371000-memory.dmpFilesize
68KB
-
memory/2364-17-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2364-15-0x0000000001800000-0x0000000001B4A000-memory.dmpFilesize
3.3MB
-
memory/3068-7-0x00000000054B0000-0x00000000054FC000-memory.dmpFilesize
304KB
-
memory/3068-2-0x0000000005730000-0x0000000005CD4000-memory.dmpFilesize
5.6MB
-
memory/3068-6-0x0000000005350000-0x000000000535C000-memory.dmpFilesize
48KB
-
memory/3068-0-0x0000000074560000-0x0000000074D10000-memory.dmpFilesize
7.7MB
-
memory/3068-8-0x0000000074560000-0x0000000074D10000-memory.dmpFilesize
7.7MB
-
memory/3068-9-0x0000000005370000-0x0000000005380000-memory.dmpFilesize
64KB
-
memory/3068-10-0x0000000006750000-0x00000000067EC000-memory.dmpFilesize
624KB
-
memory/3068-11-0x00000000067F0000-0x000000000684E000-memory.dmpFilesize
376KB
-
memory/3068-4-0x0000000005370000-0x0000000005380000-memory.dmpFilesize
64KB
-
memory/3068-14-0x0000000074560000-0x0000000074D10000-memory.dmpFilesize
7.7MB
-
memory/3068-3-0x0000000005030000-0x00000000050C2000-memory.dmpFilesize
584KB
-
memory/3068-5-0x0000000005020000-0x000000000502A000-memory.dmpFilesize
40KB
-
memory/3068-1-0x00000000005D0000-0x000000000062C000-memory.dmpFilesize
368KB
-
memory/3448-19-0x0000000008C90000-0x0000000008D9A000-memory.dmpFilesize
1.0MB
-
memory/3448-27-0x00000000030D0000-0x000000000317B000-memory.dmpFilesize
684KB
-
memory/3448-28-0x00000000030D0000-0x000000000317B000-memory.dmpFilesize
684KB
-
memory/3448-29-0x0000000008C90000-0x0000000008D9A000-memory.dmpFilesize
1.0MB
-
memory/3448-32-0x00000000030D0000-0x000000000317B000-memory.dmpFilesize
684KB
-
memory/4424-20-0x00000000002E0000-0x00000000002F9000-memory.dmpFilesize
100KB
-
memory/4424-21-0x00000000002E0000-0x00000000002F9000-memory.dmpFilesize
100KB
-
memory/4424-22-0x0000000000E00000-0x0000000000E29000-memory.dmpFilesize
164KB
-
memory/4424-23-0x0000000002D90000-0x00000000030DA000-memory.dmpFilesize
3.3MB
-
memory/4424-24-0x0000000000E00000-0x0000000000E29000-memory.dmpFilesize
164KB
-
memory/4424-26-0x0000000002BC0000-0x0000000002C50000-memory.dmpFilesize
576KB