Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    13-12-2024 21:25

General

  • Target

    The-MALWARE-Repo-master/Virus/Xpaj/xpaj.exe

  • Size

    219KB

  • MD5

    d5c12fcfeebbe63f74026601cd7f39b2

  • SHA1

    50281de9abb1bec1b6a1f13ccd3ce3493dee8850

  • SHA256

    9db7ef2d1495dba921f3084b05d95e418a16f4c5e8de93738abef2479ad5b0da

  • SHA512

    132d8c08f40a578c1dc6ac029bf2a61535087ce949ff84dbec8577505c4462358a1d9ef6cd3f58078fdcae5261d7a87348a701c28ce2357f17ecc2bc9da15b4e

  • SSDEEP

    6144:Gqmg/v4y/MqGs38KHF1SubUriPOKAJnP:jmgXxXGNKHC

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Virus\Xpaj\xpaj.exe
    "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Virus\Xpaj\xpaj.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    PID:2940

Network

  • flag-us
    DNS
    nortiniolosto.com
    xpaj.exe
    Remote address:
    8.8.8.8:53
    Request
    nortiniolosto.com
    IN A
    Response
No results found
  • 8.8.8.8:53
    nortiniolosto.com
    dns
    xpaj.exe
    63 B
    136 B
    1
    1

    DNS Request

    nortiniolosto.com

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2940-1-0x0000000000020000-0x0000000000022000-memory.dmp

    Filesize

    8KB

  • memory/2940-0-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2940-2-0x0000000000230000-0x0000000000266000-memory.dmp

    Filesize

    216KB

  • memory/2940-3-0x0000000000020000-0x0000000000022000-memory.dmp

    Filesize

    8KB

  • memory/2940-4-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/2940-5-0x0000000000230000-0x0000000000266000-memory.dmp

    Filesize

    216KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.