xloader | 8b5e45762b7ac4c0d1df861b21bae63c13f9f580668910c94f310079306acd7b

Resubmissions

27-09-2021 02:22

210927-ct33tafeam 10

24-09-2021 08:23

210924-kah8asgda9 10

Analysis

max time kernel
231s
max time network
396s
platform
windows10_x64
resource
win10-en-20210920
submitted
27-09-2021 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
Size

646KB
MD5

e9c787ebeebf1396c2fe4ccb57cbaed2
SHA1

9f88c2ee156e4757543dc5fed8f5d15388ff8548
SHA256

45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363
SHA512

942cc1021d033da4f3901bad8bd2e4c5c904367ed6b5a375e275e0385eae24f7036082b1636decb1da3a3af0d0f3152c142605bbc3e08c311ceb0527b61b0b55

Score

10^/10

xloader tr7h loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

tr7h

http://www.globalinterchangellc.com/tr7h/

Decoy

hnhstudios.com

du-lang.com

lonestartradeoilllc.com

criptool.online

rebus-automotive.com

boxedwallconsepts.net

helixarray.com

jinqiaodianfen.com

goldenwaxi.com

comprarloterianacional.com

digebitdigital.com

cryptoupp.com

332151.com

bousui.club

redakassoumeh.com

giantinosglobalreachstore.com

resultsnft.com

papicolar.com

juvesti.com

tax-kaikei.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2660-125-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/2660-126-0x000000000041D4C0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

description	pid	process	target process
PID 2068 set thread context of 2660	2068	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

pid	process
2660	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
2660	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

description	pid	process	target process
PID 2068 wrote to memory of 2660	2068	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 2068 wrote to memory of 2660	2068	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 2068 wrote to memory of 2660	2068	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 2068 wrote to memory of 2660	2068	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 2068 wrote to memory of 2660	2068	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 2068 wrote to memory of 2660	2068	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
"C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2068

C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
"C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2068-115-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/2068-117-0x0000000005770000-0x0000000005771000-memory.dmp

Filesize
4KB

Download
memory/2068-118-0x0000000005270000-0x0000000005271000-memory.dmp

Filesize
4KB

Download
memory/2068-119-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download
memory/2068-120-0x0000000005370000-0x000000000538D000-memory.dmp

Filesize
116KB

Download
memory/2068-121-0x0000000005270000-0x000000000576E000-memory.dmp

Filesize
5.0MB

Download
memory/2068-122-0x0000000006F80000-0x0000000006F81000-memory.dmp

Filesize
4KB

Download
memory/2068-123-0x00000000071C0000-0x0000000007227000-memory.dmp

Filesize
412KB

Download
memory/2068-124-0x0000000007330000-0x0000000007368000-memory.dmp

Filesize
224KB

Download
memory/2660-125-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2660-126-0x000000000041D4C0-mapping.dmp

Download
memory/2660-127-0x0000000001510000-0x0000000001830000-memory.dmp

Filesize
3.1MB

Download