Analysis

  • max time kernel
    78s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 07:53

General

  • Target

    e92a2df7e1f55fc46bacf90daa9bb34bc433c4dd6977aa3ac48e37c4fa46818a.exe

  • Size

    493KB

  • MD5

    e0f810d0ef3b5cb9b17cac7840f335d9

  • SHA1

    f55d63d6ee6258cbcc7daff7b0d6db70cf3fb449

  • SHA256

    e92a2df7e1f55fc46bacf90daa9bb34bc433c4dd6977aa3ac48e37c4fa46818a

  • SHA512

    2d2ef4d5dd6c39d0c576fa777db516da7df5ca08478e445872b458745f4d31b5ea30e7956037e6080e2994e21cf28ef798afc2d4982c7fbc593a61f8ef8d39f8

  • SSDEEP

    12288:yo02vVCPnF5+SdVr5PJPawONO/N7coUt8:yo02vGPXmwyOmoUC

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

yjqn

Decoy

ittybittybunnies.com

flordedesierto.com

cum.care

petshomespace.com

verputzarbeit.com

yuvajanmat.com

getlie.com

finanes.xyz

thelazyrando.com

domelite.design

yukinko-takasu.com

pontosmensal.com

maurlinoconstruction.com

getelectronow.com

newmexicocarwrecklawfirm.com

gunnbucks.com

ncsy30.xyz

opsem.info

authorisewallet.com

scchanghe.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader family
  • Xloader payload 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e92a2df7e1f55fc46bacf90daa9bb34bc433c4dd6977aa3ac48e37c4fa46818a.exe
    "C:\Users\Admin\AppData\Local\Temp\e92a2df7e1f55fc46bacf90daa9bb34bc433c4dd6977aa3ac48e37c4fa46818a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:532
    • C:\Users\Admin\AppData\Local\Temp\e92a2df7e1f55fc46bacf90daa9bb34bc433c4dd6977aa3ac48e37c4fa46818a.exe
      "C:\Users\Admin\AppData\Local\Temp\e92a2df7e1f55fc46bacf90daa9bb34bc433c4dd6977aa3ac48e37c4fa46818a.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2164

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/532-6-0x0000000004590000-0x00000000045E2000-memory.dmp

    Filesize

    328KB

  • memory/532-0-0x00000000744EE000-0x00000000744EF000-memory.dmp

    Filesize

    4KB

  • memory/532-2-0x00000000744E0000-0x0000000074BCE000-memory.dmp

    Filesize

    6.9MB

  • memory/532-3-0x0000000000550000-0x000000000055E000-memory.dmp

    Filesize

    56KB

  • memory/532-4-0x00000000744EE000-0x00000000744EF000-memory.dmp

    Filesize

    4KB

  • memory/532-5-0x00000000744E0000-0x0000000074BCE000-memory.dmp

    Filesize

    6.9MB

  • memory/532-1-0x00000000002F0000-0x0000000000372000-memory.dmp

    Filesize

    520KB

  • memory/532-14-0x00000000744E0000-0x0000000074BCE000-memory.dmp

    Filesize

    6.9MB

  • memory/2164-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2164-9-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2164-13-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2164-8-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2164-15-0x0000000000A60000-0x0000000000D63000-memory.dmp

    Filesize

    3.0MB

  • memory/2164-16-0x0000000000A60000-0x0000000000D63000-memory.dmp

    Filesize

    3.0MB