xloader | a687c755bac51d13e6b038d7e737261fb6922ff8eef86300058048c1f84ec844

Resubmissions

27-09-2021 02:32

210927-c1drhafeg6 10

10-09-2021 09:33

210910-ljmgrahha6 10

Analysis

max time kernel
44s
max time network
122s
platform
windows10_x64
resource
win10v20210408
submitted
10-09-2021 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83843e9448edc71956a3926bbe5dcc28cf29b375.exe
Size

501KB
MD5

d7f127ac909e3fcfed12491dff3d4f29
SHA1

83843e9448edc71956a3926bbe5dcc28cf29b375
SHA256

a687c755bac51d13e6b038d7e737261fb6922ff8eef86300058048c1f84ec844
SHA512

bac89961cb3b9f539d5aa75a9192b37128d108bd47e903eafa36882393fa2c6e1d4990c10041898a928c4b0792a8215b409ad3ce2ee572543f75a3759e01e482

Score

10^/10

xloader conv loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

conv

http://www.7stepsmeal.com/conv/

Decoy

hydrusgraphene.com

eastwindshomes.com

f1-holding.com

tomrings.com

nickysclosetnest.com

eckare88.com

southboundsupplies.com

asilar.net

ludiali.com

sarahasmussen.com

terreetmerphotography.com

tesserlink.com

xayxcq.com

jobforage.com

76leads.com

onyamarx.com

sandrinafloral.com

a5y7tvmr4.xyz

greatdanesuk.com

superbartendergigs.store

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1380-124-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral2/memory/1380-125-0x000000000041CFA0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

83843e9448edc71956a3926bbe5dcc28cf29b375.exe

description	pid	process	target process
PID 488 set thread context of 1380	488	83843e9448edc71956a3926bbe5dcc28cf29b375.exe	83843e9448edc71956a3926bbe5dcc28cf29b375.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

83843e9448edc71956a3926bbe5dcc28cf29b375.exe

pid process

1380 83843e9448edc71956a3926bbe5dcc28cf29b375.exe
1380 83843e9448edc71956a3926bbe5dcc28cf29b375.exe

pid	process
1380	83843e9448edc71956a3926bbe5dcc28cf29b375.exe
1380	83843e9448edc71956a3926bbe5dcc28cf29b375.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

83843e9448edc71956a3926bbe5dcc28cf29b375.exe

description	pid	process	target process
PID 488 wrote to memory of 1380	488	83843e9448edc71956a3926bbe5dcc28cf29b375.exe	83843e9448edc71956a3926bbe5dcc28cf29b375.exe
PID 488 wrote to memory of 1380	488	83843e9448edc71956a3926bbe5dcc28cf29b375.exe	83843e9448edc71956a3926bbe5dcc28cf29b375.exe
PID 488 wrote to memory of 1380	488	83843e9448edc71956a3926bbe5dcc28cf29b375.exe	83843e9448edc71956a3926bbe5dcc28cf29b375.exe
PID 488 wrote to memory of 1380	488	83843e9448edc71956a3926bbe5dcc28cf29b375.exe	83843e9448edc71956a3926bbe5dcc28cf29b375.exe
PID 488 wrote to memory of 1380	488	83843e9448edc71956a3926bbe5dcc28cf29b375.exe	83843e9448edc71956a3926bbe5dcc28cf29b375.exe
PID 488 wrote to memory of 1380	488	83843e9448edc71956a3926bbe5dcc28cf29b375.exe	83843e9448edc71956a3926bbe5dcc28cf29b375.exe

C:\Users\Admin\AppData\Local\Temp\83843e9448edc71956a3926bbe5dcc28cf29b375.exe
"C:\Users\Admin\AppData\Local\Temp\83843e9448edc71956a3926bbe5dcc28cf29b375.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:488

C:\Users\Admin\AppData\Local\Temp\83843e9448edc71956a3926bbe5dcc28cf29b375.exe
"C:\Users\Admin\AppData\Local\Temp\83843e9448edc71956a3926bbe5dcc28cf29b375.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1380

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/488-114-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/488-116-0x00000000055E0000-0x00000000055E1000-memory.dmp

Filesize
4KB

Download
memory/488-117-0x0000000005180000-0x0000000005181000-memory.dmp

Filesize
4KB

Download
memory/488-118-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/488-119-0x00000000050E0000-0x00000000055DE000-memory.dmp

Filesize
5.0MB

Download
memory/488-120-0x0000000005520000-0x0000000005521000-memory.dmp

Filesize
4KB

Download
memory/488-121-0x0000000005380000-0x0000000005387000-memory.dmp

Filesize
28KB

Download
memory/488-122-0x00000000088D0000-0x0000000008930000-memory.dmp

Filesize
384KB

Download
memory/488-123-0x000000000B060000-0x000000000B08A000-memory.dmp

Filesize
168KB

Download
memory/1380-124-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1380-125-0x000000000041CFA0-mapping.dmp

Download
memory/1380-126-0x00000000011D0000-0x00000000014F0000-memory.dmp

Filesize
3.1MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads