Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 20:07
General
-
Target
An Urgent-Enquiry-for-quotaion-Petrogas Agencies Power Plant Project Abu Dhabi-47574.exe
-
Size
706KB
-
MD5
16d5446ad4d79662113a4e8a669b896d
-
SHA1
dbe94c4fa5e7eda91e40480a8ce4d6ac5638b8a7
-
SHA256
d55802936c5be4116efa2f7e18a019c1adbcd8cc7c8e9682eb3f4ae5bb3f8da8
-
SHA512
3463d75a008ba0db42b28d0f1493efa1f740a8bb0982db1ad348ed61d4035e15313b2df0b0989f108c8fd20c5745120421eed9508a6b7ca3fe3e8b93957d8835
-
SSDEEP
12288:Q5oWJlP2jj5HxpyxL1D3pQKfK/aoppiyJ5bLBnB6w6:Q5oWJgj1a1DZQKupLNBBY
Malware Config
Extracted
xloader
2.6
kije
apyturkey.com
mgthehandyman.com
dick-kick.com
burntflare.com
amsecvault-services.com
moot-art.com
podemosleer.com
you-success.online
delbellointerior.com
polleriabrujas.xyz
yorkingmoroow.com
songlong8833.com
562erf.com
dhozeaccesorios.com
citychurchlloyd.com
rift-ralley.com
healsbox.com
domaindonuts.com
elversonpet.supply
texasmr.com
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload 4 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\An Urgent-Enquiry-for-quotaion-Petrogas Agencies Power Plant Project Abu Dhabi-47574.exe"C:\Users\Admin\AppData\Local\Temp\An Urgent-Enquiry-for-quotaion-Petrogas Agencies Power Plant Project Abu Dhabi-47574.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\An Urgent-Enquiry-for-quotaion-Petrogas Agencies Power Plant Project Abu Dhabi-47574.exe"C:\Users\Admin\AppData\Local\Temp\An Urgent-Enquiry-for-quotaion-Petrogas Agencies Power Plant Project Abu Dhabi-47574.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\An Urgent-Enquiry-for-quotaion-Petrogas Agencies Power Plant Project Abu Dhabi-47574.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
172KB
-
Filesize
3.3MB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
408KB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
728KB
-
Filesize
5.6MB
-
Filesize
544KB
-
Filesize
624KB
-
Filesize
584KB
-
Filesize
1.3MB
-
Filesize
1.1MB
-
Filesize
1.3MB
-
Filesize
1.1MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB