xloader | 537a1b1e9a633875a74664967b2e62803f01b619fb26df9b4762b6795ee1b0ec

Analysis

max time kernel
4s
max time network
13s
platform
windows7_x64
resource
win7v20210408
submitted
27-07-2021 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

346c1f083ba87535c999f17587d0d8b9.exe
Size

252KB
MD5

346c1f083ba87535c999f17587d0d8b9
SHA1

82a6caee2df88f4944f0f144e70f8d70675ec45e
SHA256

537a1b1e9a633875a74664967b2e62803f01b619fb26df9b4762b6795ee1b0ec
SHA512

086617b903ad3ae3c4145a9b3f122e560c64f4f0ef7a153b980f35213fa58ff5d9d480956502183ba1f310dbe0337efb81997d0f2b16a1bf751ad78935a8577b

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

http://www.extinctionbrews.com/dy8g/

Decoy

mzyxi-rkah-y.net

okinawarongnho.com

qq66520.com

nimbus.watch

cwdelrio.com

regalshopper.com

avito-payment.life

jorgeporcayo.com

galvinsky.digital

guys-only.com

asmfruits-almacenes.com

boatrace-life04.net

cochez.club

thelastvictor.net

janieleconte.com

ivoirepneus.com

saludflv.info

mydreamtv.net

austinphy.com

cajunseafoodstcloud.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/828-62-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

346c1f083ba87535c999f17587d0d8b9.exe

description pid process target process

PID 1848 set thread context of 828 1848 346c1f083ba87535c999f17587d0d8b9.exe 346c1f083ba87535c999f17587d0d8b9.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

346c1f083ba87535c999f17587d0d8b9.exe

pid process

828 346c1f083ba87535c999f17587d0d8b9.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

346c1f083ba87535c999f17587d0d8b9.exe

pid process

1848 346c1f083ba87535c999f17587d0d8b9.exe

description	pid	process	target process
PID 1848 set thread context of 828	1848	346c1f083ba87535c999f17587d0d8b9.exe	346c1f083ba87535c999f17587d0d8b9.exe

pid	process
828	346c1f083ba87535c999f17587d0d8b9.exe

pid	process
1848	346c1f083ba87535c999f17587d0d8b9.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

346c1f083ba87535c999f17587d0d8b9.exe

description	pid	process	target process
PID 1848 wrote to memory of 828	1848	346c1f083ba87535c999f17587d0d8b9.exe	346c1f083ba87535c999f17587d0d8b9.exe
PID 1848 wrote to memory of 828	1848	346c1f083ba87535c999f17587d0d8b9.exe	346c1f083ba87535c999f17587d0d8b9.exe
PID 1848 wrote to memory of 828	1848	346c1f083ba87535c999f17587d0d8b9.exe	346c1f083ba87535c999f17587d0d8b9.exe
PID 1848 wrote to memory of 828	1848	346c1f083ba87535c999f17587d0d8b9.exe	346c1f083ba87535c999f17587d0d8b9.exe
PID 1848 wrote to memory of 828	1848	346c1f083ba87535c999f17587d0d8b9.exe	346c1f083ba87535c999f17587d0d8b9.exe

C:\Users\Admin\AppData\Local\Temp\346c1f083ba87535c999f17587d0d8b9.exe
"C:\Users\Admin\AppData\Local\Temp\346c1f083ba87535c999f17587d0d8b9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1848

C:\Users\Admin\AppData\Local\Temp\346c1f083ba87535c999f17587d0d8b9.exe
"C:\Users\Admin\AppData\Local\Temp\346c1f083ba87535c999f17587d0d8b9.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:828

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-60-0x000000000041D090-mapping.dmp

Download
memory/828-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/828-63-0x00000000008D0000-0x0000000000BD3000-memory.dmp

Filesize
3.0MB

Download
memory/1848-59-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/1848-61-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download