xloader | ab101d01bcc79b6835eeeae5c3e89b0857fdd3b32e007b15ec5541a5f4aa9e00

Analysis

Target
41a25be792e86680b7a9487f0d31e154.exe
Size 242KB
Sample210728-hpkfc96456
SHA256 ab101d01bcc79b6835eeeae5c3e89b0857fdd3b32e007b15ec5541a5f4aa9e00
MD5 41a25be792e86680b7a9487f0d31e154
SHA1 b77411be10f05123fb0174bb015dd07d384a6af0
SHA512 6bc08f0801d26d4a596074062a90a1398abc085e2af7ad9ab9361184ed18fce86b5f0a11b606097d647ab6bf6072cb344f8936812f575c4668acfd3d3b9b393b
MD5 SHA1 SHA512

Score

10^/10

xloader loader rat

Family

Version

Decoy

Xloader Payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1660-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2680 set thread context of 1660	2680	41a25be792e86680b7a9487f0d31e154.exe	75

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1660	41a25be792e86680b7a9487f0d31e154.exe
1660	41a25be792e86680b7a9487f0d31e154.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2680	41a25be792e86680b7a9487f0d31e154.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 1660	2680	41a25be792e86680b7a9487f0d31e154.exe	75
PID 2680 wrote to memory of 1660	2680	41a25be792e86680b7a9487f0d31e154.exe	75
PID 2680 wrote to memory of 1660	2680	41a25be792e86680b7a9487f0d31e154.exe	75
PID 2680 wrote to memory of 1660	2680	41a25be792e86680b7a9487f0d31e154.exe	75

C:\Users\Admin\AppData\Local\Temp\41a25be792e86680b7a9487f0d31e154.exe
"C:\Users\Admin\AppData\Local\Temp\41a25be792e86680b7a9487f0d31e154.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Admin\AppData\Local\Temp\41a25be792e86680b7a9487f0d31e154.exe
  "C:\Users\Admin\AppData\Local\Temp\41a25be792e86680b7a9487f0d31e154.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660

memory/1660-116-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1660-117-0x0000000000D90000-0x0000000000E3E000-memory.dmp

Download

memory/2680-115-0x00000000007C0000-0x00000000007E3000-memory.dmp

Download