Overview

overview

10

Static

static

3

IMG_38575943.exe

windows7-x64

10

IMG_38575943.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/04/2024, 21:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    IMG_38575943.exe
  • Size 341KB
  • Sample240415-1s3yeshd82
  • SHA256 50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xloaderc6siloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • c6si

Decoy

  • tristateinc.construction

  • americanscaregroundstexas.com

  • kanimisoshiru.com

  • wihling.com

  • fishcheekstosa.com

  • parentsfuid.com

  • greenstandmarket.com

  • fc8fla8kzq.com

  • gametwist-83.club

  • jobsncvs.com

  • directrealtysells.com

  • avida2015.com

  • conceptasite.net

  • arkaneattire.com

  • indev-mobility.info

  • 2160centurypark412.com

  • valefloor.com

  • septembership.com

  • stackflix.com

  • jimc0sales.net

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader payload 4 IoCs
    rat
  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3448
    • C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe
      "C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe
        "C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"
        3⤵
          PID:2544
        • C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe
          "C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"
          3⤵
            PID:5000
          • C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe
            "C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"
            3⤵
              PID:4072
            • C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe
              "C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"
              3⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:2364
          • C:\Windows\SysWOW64\colorcpl.exe
            "C:\Windows\SysWOW64\colorcpl.exe"
            2⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4424
            • C:\Windows\SysWOW64\cmd.exe
              /c del "C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"
              3⤵
                PID:2272
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
            1⤵
              PID:3304

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  memory/2364-12-0x0000000000400000-0x0000000000429000-memory.dmp
                  Download

                  memory/2364-18-0x0000000001360000-0x0000000001371000-memory.dmp
                  Download

                  memory/2364-17-0x0000000000400000-0x0000000000429000-memory.dmp
                  Download

                  memory/2364-15-0x0000000001800000-0x0000000001B4A000-memory.dmp
                  Download

                  memory/3068-7-0x00000000054B0000-0x00000000054FC000-memory.dmp
                  Download

                  memory/3068-2-0x0000000005730000-0x0000000005CD4000-memory.dmp
                  Download

                  memory/3068-6-0x0000000005350000-0x000000000535C000-memory.dmp
                  Download

                  memory/3068-0-0x0000000074560000-0x0000000074D10000-memory.dmp
                  Download

                  memory/3068-8-0x0000000074560000-0x0000000074D10000-memory.dmp
                  Download

                  memory/3068-9-0x0000000005370000-0x0000000005380000-memory.dmp
                  Download

                  memory/3068-10-0x0000000006750000-0x00000000067EC000-memory.dmp
                  Download

                  memory/3068-11-0x00000000067F0000-0x000000000684E000-memory.dmp
                  Download

                  memory/3068-4-0x0000000005370000-0x0000000005380000-memory.dmp
                  Download

                  memory/3068-14-0x0000000074560000-0x0000000074D10000-memory.dmp
                  Download

                  memory/3068-3-0x0000000005030000-0x00000000050C2000-memory.dmp
                  Download

                  memory/3068-5-0x0000000005020000-0x000000000502A000-memory.dmp
                  Download

                  memory/3068-1-0x00000000005D0000-0x000000000062C000-memory.dmp
                  Download

                  memory/3448-19-0x0000000008C90000-0x0000000008D9A000-memory.dmp
                  Download

                  memory/3448-27-0x00000000030D0000-0x000000000317B000-memory.dmp
                  Download

                  memory/3448-28-0x00000000030D0000-0x000000000317B000-memory.dmp
                  Download

                  memory/3448-29-0x0000000008C90000-0x0000000008D9A000-memory.dmp
                  Download

                  memory/3448-32-0x00000000030D0000-0x000000000317B000-memory.dmp
                  Download

                  memory/4424-20-0x00000000002E0000-0x00000000002F9000-memory.dmp
                  Download

                  memory/4424-21-0x00000000002E0000-0x00000000002F9000-memory.dmp
                  Download

                  memory/4424-22-0x0000000000E00000-0x0000000000E29000-memory.dmp
                  Download

                  memory/4424-23-0x0000000002D90000-0x00000000030DA000-memory.dmp
                  Download

                  memory/4424-24-0x0000000000E00000-0x0000000000E29000-memory.dmp
                  Download

                  memory/4424-26-0x0000000002BC0000-0x0000000002C50000-memory.dmp
                  Download