Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 22:30
General
-
Target
Báo giá 2021 30 tháng 7.exe
-
Size
471KB
-
MD5
c9a3d8f7a9dd8083b71ce917f47b3585
-
SHA1
942bf56700fdac19501dfeb1f59f6e6337e6eca9
-
SHA256
b723bfaea352b22e8ccf6b100fdde75ab6db665870f8a307be193d6e321e5383
-
SHA512
6176595448c11151d1df8dabb22820b0239cfbf60d443d262f89c32fe099c4879b25ae99652a1fb1dd78b4fcbe4d41ed1c8dad72d962f25e83e0e9f569ed4dcb
-
SSDEEP
12288:OI35Bx86innnnnnnqtEa3TAj/AF6qsrJ1Wd6XSXeQj:O0hinnnnnnnqtmIE/rJ1YIBQj
Malware Config
Extracted
xloader
2.3
d8ak
slingshots305.com
egemv.com
purplewrld.com
thaipayakorn.com
crontabcyber.com
wolfalike.com
tedstbrice.com
bbwtrip.com
clothestokidsri.com
experienanidworks.com
acuityhealthcare.xyz
applepai.net
happytownmayor.net
xn--vltadvisors-2eb.com
garbagegenius.com
ndddxs.com
accuratearrangements.com
wraptecny.com
torontomassage.club
ifem-ci.com
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload 4 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
-
Suspicious behavior: MapViewOfSection 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Báo giá 2021 30 tháng 7.exe"C:\Users\Admin\AppData\Local\Temp\Báo giá 2021 30 tháng 7.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Báo giá 2021 30 tháng 7.exe"C:\Users\Admin\AppData\Local\Temp\Báo giá 2021 30 tháng 7.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Báo giá 2021 30 tháng 7.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
-
Filesize
160KB
-
Filesize
92KB
-
Filesize
272KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
64KB
-
Filesize
940KB
-
Filesize
772KB
-
Filesize
940KB
-
Filesize
772KB
-
Filesize
688KB
-
Filesize
688KB
-
Filesize
688KB
-
Filesize
4KB
-
Filesize
272KB
-
Filesize
272KB