Analysis
- max time kernel
136s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
20/07/2024, 10:58
General
- Target 9b38c45acf649b5db02318330583b66e8f70f637a54ef40db50afbef85a0cbb6.exe
- Size 651KB
- Sample240720-m22vtsscke
- SHA256 9b38c45acf649b5db02318330583b66e8f70f637a54ef40db50afbef85a0cbb6
Malware Config
Extracted
-
xloader
-
2.7
-
uem3
-
darwinschools.com
-
polytherm-vloerverwarming.com
-
sinibelanja.website
-
erasemy.info
-
domainedelapoujade.info
-
freidaperry.com
-
ensoustudio.com
-
xjyjjy.com
-
ezhuilike.com
-
equipoheza.com
-
vtsr-health.com
-
elanagro.online
-
savas-jewelry.com
-
hispahoo.com
-
nlsc.chat
-
wharxl.icu
-
funandfoodboat.com
-
usdtsearch.com
-
experimentguardian.xyz
-
bikeell.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b38c45acf649b5db02318330583b66e8f70f637a54ef40db50afbef85a0cbb6.exe"C:\Users\Admin\AppData\Local\Temp\9b38c45acf649b5db02318330583b66e8f70f637a54ef40db50afbef85a0cbb6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9b38c45acf649b5db02318330583b66e8f70f637a54ef40db50afbef85a0cbb6.exe"C:\Users\Admin\AppData\Local\Temp\9b38c45acf649b5db02318330583b66e8f70f637a54ef40db50afbef85a0cbb6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4388-6-0x0000000006370000-0x000000000637E000-memory.dmp
memory/4388-10-0x0000000007DE0000-0x0000000007E7C000-memory.dmp
memory/4388-2-0x00000000055B0000-0x0000000005B54000-memory.dmp
memory/4388-3-0x0000000005000000-0x0000000005092000-memory.dmp
memory/4388-4-0x0000000004F70000-0x0000000004F7A000-memory.dmp
memory/4388-5-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/4388-1-0x00000000004D0000-0x000000000057A000-memory.dmp
memory/4388-8-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/4388-0-0x00000000747CE000-0x00000000747CF000-memory.dmp
memory/4388-9-0x0000000006A70000-0x0000000006AD8000-memory.dmp
memory/4388-7-0x00000000747CE000-0x00000000747CF000-memory.dmp
memory/4388-11-0x0000000006930000-0x0000000006962000-memory.dmp
memory/4388-14-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/5068-12-0x0000000000400000-0x000000000042B000-memory.dmp
memory/5068-15-0x0000000001710000-0x0000000001A5A000-memory.dmp