xloader | ef925865b194ddd0d59233fec99f8e3608a623c3d4f7eaaf34b9af57f9bb0a82

Analysis

Target
64b8ce71634358d220c7eb599a73556d.exe
Size 337KB
Sample210728-ebdbedaqvs
SHA256 ef925865b194ddd0d59233fec99f8e3608a623c3d4f7eaaf34b9af57f9bb0a82
MD5 64b8ce71634358d220c7eb599a73556d
SHA1 06d0687b32181d1611d20c60078526850049e38b
SHA512 54ed51ed7ce72d0f4045b5a7f253ee88d503196085e0497fd4ef8599254bce570161da43b6ac949a15629f1f58777971696eaea6e4dd345e6ae0f8d698f48ba4
MD5 SHA1 SHA512

Score

10^/10

xloader loader rat

Family

Version

Decoy

Xloader Payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1400-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3156 set thread context of 1400	3156	64b8ce71634358d220c7eb599a73556d.exe	75

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1400	64b8ce71634358d220c7eb599a73556d.exe
1400	64b8ce71634358d220c7eb599a73556d.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3156	64b8ce71634358d220c7eb599a73556d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 1400	3156	64b8ce71634358d220c7eb599a73556d.exe	75
PID 3156 wrote to memory of 1400	3156	64b8ce71634358d220c7eb599a73556d.exe	75
PID 3156 wrote to memory of 1400	3156	64b8ce71634358d220c7eb599a73556d.exe	75
PID 3156 wrote to memory of 1400	3156	64b8ce71634358d220c7eb599a73556d.exe	75

C:\Users\Admin\AppData\Local\Temp\64b8ce71634358d220c7eb599a73556d.exe
"C:\Users\Admin\AppData\Local\Temp\64b8ce71634358d220c7eb599a73556d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Users\Admin\AppData\Local\Temp\64b8ce71634358d220c7eb599a73556d.exe
  "C:\Users\Admin\AppData\Local\Temp\64b8ce71634358d220c7eb599a73556d.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1400

memory/1400-116-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1400-117-0x0000000000A30000-0x0000000000D50000-memory.dmp

Download

memory/3156-115-0x00000000006C0000-0x00000000006C2000-memory.dmp

Download