Analysis

  • max time kernel
    148s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-12-2024 12:40

General

  • Target

    Inv_7623980.exe

  • Size

    829KB

  • MD5

    b20d9ced5d063ec28425551a520ac59d

  • SHA1

    f6bfd3346ed28ef6ed5e45d89f6b1f89d8296b0f

  • SHA256

    3ad516ed1d59d2a83e03dd014de474999c1d20885639cd2f77c1108c636636df

  • SHA512

    2bbfa0ab4ef7132e5740e54d1fcacb35fdbea4a89b5208f42b4660377f5e18f7a09cad7c589d3a1c3b02d06228ba8b3cb02d6f32b0fcf18b71f23c0e367c48d4

  • SSDEEP

    12288:sJzJBoc+ZPzbmhJP8jA+09+Ny6UMZET3jcqd+lHLN3BwspCVad5+v991DqGTR:sjec+ZPzbmf8jFNu4ETQqwtBw

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

m6b5

Decoy

ixtarbelize.com

pheamal.com

daiyncc.com

staydoubted.com

laagerlitigation.club

sukrantastansakarya.com

esupport.ltd

vetscontracting.net

themuslimlife.coach

salmanairs.com

somatictherapyservices.com

lastminuteminister.com

comunicarbuenosaires.com

kazuya.tech

insightlyservicedev.com

redevelopment38subhashnagar.com

thefutureinvestor.com

simplysu.com

lagu45.com

livingstonpistolpermit.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader family
  • Xloader payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe
      "C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2800
    • C:\Windows\SysWOW64\wininit.exe
      "C:\Windows\SysWOW64\wininit.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1212-20-0x0000000005180000-0x0000000005289000-memory.dmp

    Filesize

    1.0MB

  • memory/1212-25-0x0000000005180000-0x0000000005289000-memory.dmp

    Filesize

    1.0MB

  • memory/2024-6-0x0000000005250000-0x00000000052D8000-memory.dmp

    Filesize

    544KB

  • memory/2024-3-0x0000000000320000-0x0000000000328000-memory.dmp

    Filesize

    32KB

  • memory/2024-4-0x00000000745DE000-0x00000000745DF000-memory.dmp

    Filesize

    4KB

  • memory/2024-5-0x00000000745D0000-0x0000000074CBE000-memory.dmp

    Filesize

    6.9MB

  • memory/2024-2-0x00000000745D0000-0x0000000074CBE000-memory.dmp

    Filesize

    6.9MB

  • memory/2024-7-0x0000000002050000-0x000000000208A000-memory.dmp

    Filesize

    232KB

  • memory/2024-1-0x00000000003E0000-0x00000000004B6000-memory.dmp

    Filesize

    856KB

  • memory/2024-0-0x00000000745DE000-0x00000000745DF000-memory.dmp

    Filesize

    4KB

  • memory/2024-15-0x00000000745D0000-0x0000000074CBE000-memory.dmp

    Filesize

    6.9MB

  • memory/2648-24-0x0000000000080000-0x00000000000A9000-memory.dmp

    Filesize

    164KB

  • memory/2648-21-0x0000000000480000-0x000000000049A000-memory.dmp

    Filesize

    104KB

  • memory/2648-23-0x0000000000480000-0x000000000049A000-memory.dmp

    Filesize

    104KB

  • memory/2800-10-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2800-18-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2800-19-0x0000000000130000-0x0000000000140000-memory.dmp

    Filesize

    64KB

  • memory/2800-16-0x0000000000AC0000-0x0000000000DC3000-memory.dmp

    Filesize

    3.0MB

  • memory/2800-14-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2800-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2800-8-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB