Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 19:53
General
-
Target
881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe
-
Size
802KB
-
MD5
66fe9fc4a048631ec4ac9bc4ad55f501
-
SHA1
302188f68b430e20f0f28d8ec9697a216e341d79
-
SHA256
881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a
-
SHA512
71b6fa38cc25d2ceb360b6b6ac6d725cd2137d8e4cd660bd1829997d2223ea9123d247006b3afee96e650b9014871b1d9579d69faa590c6501016a3152243530
-
SSDEEP
24576:dLa/diQs7a/ichDPvzoKndNQ2dliGBUam:dLlW/Nz/TNqNam
Malware Config
Extracted
xloader
2.5
q3c8
illstarttommorow.com
ll-safe-keepingtoyof5.xyz
mygreenequity.com
albionadesign.com
byzalikha.com
robinson.tools
mrd68.com
mw13racing.com
pirankaliyar.com
nropes.com
indigosrc.com
drsyverson.com
aprendes.academy
mundohightech.com
sarms-research.com
ilmarijuanadispensary.com
qabeta3473437.com
businessmastercenturion.com
axissol.net
market-oplata-23v.xyz
Signatures
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Xloader payload 2 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
-
Suspicious use of WriteProcessMemory 31 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe"C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe"2⤵
- UAC bypass
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\0r6lS7c\svchost.exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\0r6lS7c\svchost.exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension "exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\rdrleakdiag.exe"C:\Windows\SysWOW64\rdrleakdiag.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\rdrleakdiag.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD506712a73a342fa69f39f8e8001e22f76
SHA11bc9f686a1d3bb58be4cd7130410a4b6f881df25
SHA2562164229f4d58cf79995cde057d842a8c028cb25f629a56e2847e8fd3961d9ee4
SHA51283939dcf92624bf000438aef8e1e2d53786a3d3416f761d3811692c7b468f8526c5731ab5dc5d0c4a1ac5f1c836d6c1724994a66b6f3e1ca4af5264b4944ae45
-
Filesize
18KB
MD53f43001fe7348c73d754b507d59056ed
SHA13c3245d43a2824fd7780839e14e2fce2463cc09d
SHA256e53afe85c34a193c55825a6809a5c1b5e206cf3d029ef86cd5d56875f417e2b5
SHA512981a6f44cb2783f90df9cb6b31cc44d7d918f74faa3932d5faa0399c9c8d337567b745999c8ded8a9f4c6d5e718b49c0394e4bf5a63e20ceafeb0828800c4dd2
-
Filesize
18KB
MD54b1c930765bad751727b636f36290189
SHA114005ff14ad0e590c77befdba6e2fc47132ab758
SHA2566b13538cf69b683b9cd7b0fefa830fa9d6a1adad4e7ab9bce3fda2db8cfd30d4
SHA512a5c2f04b60b85ae4bb5d05d4319160fd6309b4b12e1a023e1582f9e469e542d07addde97cff2a8045b10aefbb135eb7e7da718bbc7b03c307fa4cc1e772cd054
-
Filesize
18KB
MD5c64a007edd61099d2319006a063941ab
SHA12a7bce936e1c8261f2d572e0e8fcbe2f20b90ca2
SHA2561a6085b109aade075864b92e2ed9d4304d7517f552b3cfe6e2288f825128193f
SHA512ca4f085d15432c2ab0d2a5fe0d0fb5e08a8b3ec3797c4601d077e8bcc579e69beb5e36666ce6a3e0bc3ddb82e88cc1c7429cccb464ea72f5f71cc5f5598cbdd7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
168KB
-
Filesize
4.2MB
-
Filesize
164KB
-
Filesize
4.2MB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
200KB
-
Filesize
652KB
-
Filesize
120KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
68KB
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
7.7MB
-
Filesize
6.2MB
-
Filesize
1.1MB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
280KB
-
Filesize
744KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
824KB