Analysis
-
max time kernel
94s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 22:31
General
-
Target
win32.exe
-
Size
370KB
-
MD5
a9603bd99100cac3d701d5294228bf19
-
SHA1
10b504ddd800474cd328ce3600b68698c52c342f
-
SHA256
56f6ae8977212fbc76c8395b969260cbb6daa8e73a6118b0e1493ab71722ddc8
-
SHA512
549c3bcf0e1ccea52e1ee48a893b801ff77dbb99dde1752e563e8b042009cad08d1ce4448e9bd27ee6353916beb2767c897d3631f7303f3cba77d31d80a57ac2
-
SSDEEP
6144:45yeUG+CmIqC73I6OYBmVX8cp6RetfXhdJo7LgBq1KfXr/UV1qi:45bDKIqCk6jEscpieNXhdOPM0Kvr/pi
Malware Config
Extracted
xloader
2.3
e8mc
cristiansantacruz.com
martijnvanderlinden.media
magen-tracks.xyz
sdghotel.com
vigilantmagazine.com
baihuaresort.com
zealoteck.com
qr-world.info
madousp.info
gmailcoo.com
beautychoicecosmetics.com
ninjadigitalmarketing.net
bestdormroomessentials.com
partsground.com
nhimlike.com
onatstore.com
zoisalud.com
atxrepublicans.com
spellsislam.com
about-sexy.com
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\win32.exe"C:\Users\Admin\AppData\Local\Temp\win32.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 2202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4768 -ip 47681⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
160KB
-
Filesize
4.3MB