Analysis
- max time kernel
96s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
02/09/2024, 03:52
General
- Target 469a72800277832b6861e5ca5119e5719ece7a09bee33d96292f81a06023ee8a.exe
- Size 435KB
- Sample240902-ee6w9ssaqb
- SHA256 469a72800277832b6861e5ca5119e5719ece7a09bee33d96292f81a06023ee8a
Score
10/10
Malware Config
Extracted
Family
-
xloader
Version
-
2.3
Campaign
-
9bwn
Decoy
-
italiancoastal.com
-
shareandfit.com
-
ibexacademia.com
-
guejek.com
-
vitalbizdev.com
-
connemaracomputers.com
-
surf-livre.com
-
styleforwoman.com
-
costcopaysecure.com
-
kingdomandqueendom.com
-
www-societegenerale.com
-
radiokerbfm.com
-
marylandstars.net
-
thechampionsday.com
-
beertenderb95.com
-
iybbshop.com
-
maglex.info
-
vh3g.asia
-
zaairobot.online
-
ryderhydros.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\469a72800277832b6861e5ca5119e5719ece7a09bee33d96292f81a06023ee8a.exe"C:\Users\Admin\AppData\Local\Temp\469a72800277832b6861e5ca5119e5719ece7a09bee33d96292f81a06023ee8a.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\469a72800277832b6861e5ca5119e5719ece7a09bee33d96292f81a06023ee8a.exe"C:\Users\Admin\AppData\Local\Temp\469a72800277832b6861e5ca5119e5719ece7a09bee33d96292f81a06023ee8a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2876-2-0x0000000000390000-0x00000000003B8000-memory.dmp
memory/2876-5-0x0000000000D40000-0x000000000108A000-memory.dmp
memory/2892-1-0x00000000000A0000-0x00000000001A0000-memory.dmp