Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
21-11-2024 20:16
General
-
Target
b.exe
-
Size
164KB
-
MD5
abcf9c4951969838d5f6ba1c366628f2
-
SHA1
ed7503276c7ffbab2caa4ee5162e9bbda42fa921
-
SHA256
3a273798af77eead6eb9269b272f25c99a26ca3f6c7e38567249f66484f6edec
-
SHA512
073cbafd67ca5399e32b52cd2bc4b91161799b955d96f53d1549c113e578f6be7464a30b5f9c649db47045d8e0b19cafde150c1d3f7b4b84529016147b3e2572
-
SSDEEP
3072:MpW/wWQ5EkDbwmSuoUufCzPwcldRhJYPe+rrWbKpDhwi9F4bb:tTHduoD8IcldR8W+rrjp9D9F4b
Malware Config
Extracted
xloader
2.5
u8cq
ardentb.com
kaeltefath.com
galataegitimkurumlari.net
rap8b55d.com
zn9998.com
alvinceremiaam.xyz
whitecorp.net
plandout.com
craftscora.com
katx.info
ruleship.com
qinuxdrone4k.com
vtprealtor.com
serviciomovistar.online
amazon939.com
gm8898.com
housesyrron.com
impqtantaou.com
linksmarttech.net
tubbipets.com
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\b.exe"C:\Users\Admin\AppData\Local\Temp\b.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
3.0MB
-
Filesize
4KB
-
Filesize
164KB
-
Filesize
164KB
-
Filesize
4KB