Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2024 20:07

General

  • Target

    982e727a53a27d2bfbaea608209b315bc892947a1ef954033f1b29c687b6e001.exe

  • Size

    885KB

  • MD5

    b8c17d08c78f88e49edd77c35b47e851

  • SHA1

    43bb31c71c84de912fbc4b2df45df445e0fd5de4

  • SHA256

    982e727a53a27d2bfbaea608209b315bc892947a1ef954033f1b29c687b6e001

  • SHA512

    6489e1f5412c854d5b0b7d6761b9fe2bb5871b438c4bedc2080a9a0cc596f2c1fa2ce66e8d82c49611b973e6415214e52051db70a7af71db223fd3d8c3e79309

  • SSDEEP

    12288:C1apH3333333PfJ55555555CaqaF0qMgmxd0C66baBTn0huT/pWygoptzU6Lm/GD:/X6TgCd05BTtpWDoDzU6LmO7SlEZLx

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

uit2

Decoy

transmutualinformation.com

northcarolinahempcrete.com

exceedrigging.online

verifiedpaypal.net

notlieu.xyz

cdn-corp.com

wz-edu.net

chaelve.xyz

lifesongcounselling.com

misterpeppers.toys

shortfatotaku.com

divineluxmedia.com

creative-solutionco.com

daumien.com

adenomyxosarcoma.com

permanentcleaning.com

bettyandcharlie.com

premium-gutters.com

shnuffle.com

trichycateringservices.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader family
  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\982e727a53a27d2bfbaea608209b315bc892947a1ef954033f1b29c687b6e001.exe
    "C:\Users\Admin\AppData\Local\Temp\982e727a53a27d2bfbaea608209b315bc892947a1ef954033f1b29c687b6e001.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Users\Admin\AppData\Local\Temp\982e727a53a27d2bfbaea608209b315bc892947a1ef954033f1b29c687b6e001.exe
      "C:\Users\Admin\AppData\Local\Temp\982e727a53a27d2bfbaea608209b315bc892947a1ef954033f1b29c687b6e001.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2368-6-0x0000000007E70000-0x0000000007F20000-memory.dmp

    Filesize

    704KB

  • memory/2368-0-0x000000007470E000-0x000000007470F000-memory.dmp

    Filesize

    4KB

  • memory/2368-2-0x0000000074700000-0x0000000074DEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2368-3-0x0000000000670000-0x000000000067E000-memory.dmp

    Filesize

    56KB

  • memory/2368-4-0x000000007470E000-0x000000007470F000-memory.dmp

    Filesize

    4KB

  • memory/2368-5-0x0000000074700000-0x0000000074DEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2368-1-0x0000000000C20000-0x0000000000D04000-memory.dmp

    Filesize

    912KB

  • memory/2368-7-0x00000000043C0000-0x00000000043F0000-memory.dmp

    Filesize

    192KB

  • memory/2368-13-0x0000000074700000-0x0000000074DEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2796-12-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2796-8-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2796-9-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2796-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2796-14-0x0000000000D10000-0x0000000001013000-memory.dmp

    Filesize

    3.0MB