Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
31/08/2024, 01:34
General
- Target czOxHskgIAQwZ8m.exe
- Size 425KB
- Sample240831-bzerqsyale
- SHA256 856b8775a8063900378a815cd03d0f9628c4296eddd93ac9e9cd52269178c079
Malware Config
Extracted
-
xloader
-
2.5
-
amb4
-
ameerkabob.com
-
wenzhikeji.online
-
ktnsoil.xyz
-
dock7rods.com
-
simbaimmigration.com
-
tanahvilamalino.online
-
amaozn-co-jp.xyz
-
atahukukbafra.com
-
attruth.net
-
jigservices.net
-
310indianway.com
-
freelotto.online
-
mylanding-page.com
-
dudemealprep.com
-
wellmaintainedhealth.com
-
vitemonprenom.com
-
laurynfauntroy.com
-
pilotmom.info
-
arpatientsapp.com
-
sendangdigital.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 4 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 52 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\czOxHskgIAQwZ8m.exe"C:\Users\Admin\AppData\Local\Temp\czOxHskgIAQwZ8m.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\czOxHskgIAQwZ8m.exe"C:\Users\Admin\AppData\Local\Temp\czOxHskgIAQwZ8m.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\czOxHskgIAQwZ8m.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1348-27-0x0000000000BC0000-0x0000000000BE9000-memory.dmp
memory/1348-25-0x0000000000F00000-0x0000000001333000-memory.dmp
memory/1348-26-0x0000000000F00000-0x0000000001333000-memory.dmp
memory/3488-28-0x00000000092F0000-0x000000000940E000-memory.dmp
memory/3488-31-0x0000000009830000-0x00000000099B7000-memory.dmp
memory/3488-33-0x0000000009830000-0x00000000099B7000-memory.dmp
memory/3488-23-0x00000000091A0000-0x00000000092EF000-memory.dmp
memory/3488-22-0x00000000092F0000-0x000000000940E000-memory.dmp
memory/3488-18-0x00000000091A0000-0x00000000092EF000-memory.dmp
memory/4060-16-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4060-20-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4060-21-0x0000000001380000-0x0000000001391000-memory.dmp
memory/4060-11-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4060-14-0x00000000013E0000-0x000000000172A000-memory.dmp
memory/4060-17-0x0000000001310000-0x0000000001321000-memory.dmp
memory/5068-6-0x0000000007710000-0x000000000771E000-memory.dmp
memory/5068-13-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/5068-10-0x0000000008950000-0x00000000089A2000-memory.dmp
memory/5068-9-0x0000000008860000-0x00000000088FC000-memory.dmp
memory/5068-8-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/5068-7-0x00000000751AE000-0x00000000751AF000-memory.dmp
memory/5068-0-0x00000000751AE000-0x00000000751AF000-memory.dmp
memory/5068-5-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/5068-4-0x0000000004AD0000-0x0000000004ADA000-memory.dmp
memory/5068-3-0x0000000007510000-0x00000000075A2000-memory.dmp
memory/5068-2-0x0000000007A10000-0x0000000007FB4000-memory.dmp
memory/5068-1-0x00000000005F0000-0x0000000000660000-memory.dmp