Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
27/03/2025, 08:55
General
-
Target
Order Specification Requirement With Ref. AMABINIF38535.exe
-
Size
558KB
-
MD5
ec44d0c4ec44347f9f8ee63b4bec5210
-
SHA1
362eda0fa5bd2cd4f50d0f7e9cf0cc641a08b163
-
SHA256
ed6182df3469dfdc4084aea0aca3714a90498401d608c7a0ab818329c42ab21f
-
SHA512
ee7e79980421b97fccdbe453c5daa98798fc82e8951c3d6aee49a939a1721e2c885ad22c69721488644f277e719d60d2fd1a8f595ceb370d29d899bbca7e1338
-
SSDEEP
6144:AO6oVJ59N2c3FEyohRbTnIkwcDku8dQDKfcQqUwSLjiXTkgQ:ASJ59r3F0bTnlwcDkuzMcfSLYTTQ
Malware Config
Extracted
xloader
2.2
utau
frenchtogether.info
thefriendsofmaryc.com
meridianconversation.com
pleasingpleasure.com
relliant-rehab.com
meunegocioonlineoficial.com
jutuiess.site
sorelshopitalia.com
minnesotaunited.club
meditationmateau.com
wisheskennel.com
nothingbeatsagreatstory.com
equityinengineering.com
designantageuk.com
towstate.com
floridapremierestates.com
qianwanshang.com
mamentos.info
coraltechnologygroup.com
guoyijidian.com
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload 2 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order Specification Requirement With Ref. AMABINIF38535.exe"C:\Users\Admin\AppData\Local\Temp\Order Specification Requirement With Ref. AMABINIF38535.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order Specification Requirement With Ref. AMABINIF38535.exe"C:\Users\Admin\AppData\Local\Temp\Order Specification Requirement With Ref. AMABINIF38535.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Order Specification Requirement With Ref. AMABINIF38535.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
164KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
164KB
-
Filesize
416KB
-
Filesize
12KB
-
Filesize
12KB