Analysis

  • max time kernel
    148s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    23-08-2024 18:34

General

  • Target

    PO#652.exe

  • Size

    345KB

  • MD5

    095d3e149a73c5daa7da04428ee3d561

  • SHA1

    a2bee1c142d50ef4f821e30eae5a1a30efa8f009

  • SHA256

    a8fe6d7fa624e8e96f71d3ff6375a012b44b51f06179feb7cef8c33fd6d38570

  • SHA512

    69912e46c134c99f03af4dbc9dd9dbd7da100e56c513d7be6f92d38a69eae2094c85aab239dff41d5a84dfe3e92dc730e0653f74e668e556d9c84d4ad677b650

  • SSDEEP

    6144:vv0M3Nkx/86kMUoM4fonNsK1UQR24dkyc1QCPBvHgy8DPlJB7F9GzypL1yO42s2b:vcM3H6kM7gnRBR24yRPBPgy8DNFwe7ya

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

m3de

Decoy

ad-unity.com

republicans2032.com

blackculturewriters.com

wallnewphoto.com

etripideas.com

solarphlare.com

consultoranexo.com

hayasalon.com

pillowcasefactory.club

service-manbzcsexer.com

medicinerx.today

oliviarescigno.com

tomcruise.club

tetsim.com

atonalai.net

malcomsons.com

straitskids.com

luca-cci.com

pero.financial

wowbdshop.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Core1 .NET packer 1 IoCs

    Detects packer/loader used by .NET malware.

  • Xloader payload 5 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1252
    • C:\Users\Admin\AppData\Local\Temp\PO#652.exe
      "C:\Users\Admin\AppData\Local\Temp\PO#652.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1596
      • C:\Windows\SysWow64\svchost.exe
        "C:\\Windows\\SysWow64\\svchost.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2804
    • C:\Windows\SysWOW64\msdt.exe
      "C:\Windows\SysWOW64\msdt.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2952
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWow64\svchost.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2600

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1252-16-0x0000000004520000-0x00000000045D5000-memory.dmp

    Filesize

    724KB

  • memory/1252-27-0x00000000076C0000-0x0000000007846000-memory.dmp

    Filesize

    1.5MB

  • memory/1252-22-0x0000000004520000-0x00000000045D5000-memory.dmp

    Filesize

    724KB

  • memory/1252-21-0x00000000076C0000-0x0000000007846000-memory.dmp

    Filesize

    1.5MB

  • memory/1596-11-0x000007FEF4F10000-0x000007FEF58FC000-memory.dmp

    Filesize

    9.9MB

  • memory/1596-4-0x00000000008F0000-0x0000000000906000-memory.dmp

    Filesize

    88KB

  • memory/1596-6-0x0000000000910000-0x0000000000914000-memory.dmp

    Filesize

    16KB

  • memory/1596-1-0x000000013F7C0000-0x000000013F81A000-memory.dmp

    Filesize

    360KB

  • memory/1596-2-0x00000000020D0000-0x0000000002112000-memory.dmp

    Filesize

    264KB

  • memory/1596-5-0x000007FEF4F10000-0x000007FEF58FC000-memory.dmp

    Filesize

    9.9MB

  • memory/1596-0-0x000007FEF4F13000-0x000007FEF4F14000-memory.dmp

    Filesize

    4KB

  • memory/1596-3-0x00000000008F0000-0x0000000000918000-memory.dmp

    Filesize

    160KB

  • memory/2804-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2804-15-0x0000000000120000-0x0000000000130000-memory.dmp

    Filesize

    64KB

  • memory/2804-14-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2804-18-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2804-19-0x00000000001A0000-0x00000000001B0000-memory.dmp

    Filesize

    64KB

  • memory/2804-12-0x0000000000950000-0x0000000000C53000-memory.dmp

    Filesize

    3.0MB

  • memory/2804-8-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2804-7-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2952-23-0x0000000000C60000-0x0000000000D54000-memory.dmp

    Filesize

    976KB

  • memory/2952-25-0x0000000000C60000-0x0000000000D54000-memory.dmp

    Filesize

    976KB

  • memory/2952-26-0x00000000000C0000-0x00000000000E8000-memory.dmp

    Filesize

    160KB