Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2024 05:31

General

  • Target

    1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe

  • Size

    251KB

  • MD5

    2627ba100abc4933106893191384a31d

  • SHA1

    a5e77daa3cd30c6ed8106380d408534aac4e6eeb

  • SHA256

    1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac

  • SHA512

    3769f5645a0e310865fea09e3ca027aebb1b3efde328157b73c61187b3158301e102e5d56a17140fb0d36533c89bede93f124bc657dff9237b6112b2d8c935f7

  • SSDEEP

    6144:wBlL/cR8tpViH8hHseEJ1eG6/211J5nQEnURg0HZoAg:CeRSpNhH1EGZc5tURggZoAg

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

m5cw

Decoy

stolpfabriken.com

aromaessentialco.com

rmcclaincpa.com

wuruixin.com

sidhyanticlasses.com

horilka.store

organic-outlaws.com

customsoftwarelogistics.com

cheryltesting.com

thecompacthomegym.com

the22yards.club

quickloanprovidersservices.com

grippyent.com

guard-usa.com

agircredit.com

classificationmetallurgie.com

quizzesandcode.com

catdanos.com

8676789.rest

gotbestshavlngplansforyou.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader family
  • Xloader payload 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe
    "C:\Users\Admin\AppData\Local\Temp\1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Users\Admin\AppData\Local\Temp\1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe
      "C:\Users\Admin\AppData\Local\Temp\1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsd9EFE.tmp\ztqv.dll

    Filesize

    32KB

    MD5

    97d84d39bb68b5a29e976b40d7d0a00c

    SHA1

    cf4c09487fffb9ace9ab6b82f33da0d5a851ef1c

    SHA256

    5b29c5ee49d9cdde15d88a9e4f8f6b4bba9e2dc4ec65c02d734726fe0f2952c8

    SHA512

    aab5b8831538f96c00e77f16349065bfaa93e7b25206a6d5fe0871f518f38ae31437f2f9f93f36f488e1869eaf97dd4697a282d726ce9a292cf4276242733546

  • memory/2388-9-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2420-7-0x0000000010008000-0x000000001000A000-memory.dmp

    Filesize

    8KB