xloader | 68d833bbc98fa8c14cab1c22f458f0ec7a971b908365767514a8e2c1e3504f2f

Resubmissions

11-01-2022 04:01

220111-ell6fafcaj 10

11-01-2022 03:55

220111-egyzfaehd2 10

Analysis

max time kernel
360s
max time network
360s
platform
windows7_x64
resource
win7-en-20211208
submitted
11-01-2022 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe
Size

715KB
MD5

f444b6e1dfea126b54556aa8b3321f9a
SHA1

7c318d0d03dc5ad399b5fe764c1cbb132faf6c1b
SHA256

538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7
SHA512

08ef03f4fd192cbfb0d322c3ba4f71940322f7fea7c477e67d53387cb6d321561d76462c8b6812f3627524d05bdaf89a14afd51b2fd5d02de2f0299cd1507d81

Score

10^/10

xloader ef6c loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1304-60-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1304-61-0x000000000041D3D0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe

description	pid	process	target process
PID 1880 set thread context of 1304	1880	538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe	538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe

pid process

1304 538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe

pid	process
1304	538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe

description	pid	process	target process
PID 1880 wrote to memory of 1304	1880	538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe	538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe
PID 1880 wrote to memory of 1304	1880	538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe	538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe
PID 1880 wrote to memory of 1304	1880	538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe	538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe
PID 1880 wrote to memory of 1304	1880	538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe	538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe
PID 1880 wrote to memory of 1304	1880	538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe	538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe
PID 1880 wrote to memory of 1304	1880	538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe	538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe
PID 1880 wrote to memory of 1304	1880	538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe	538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe

C:\Users\Admin\AppData\Local\Temp\538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe
"C:\Users\Admin\AppData\Local\Temp\538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Users\Admin\AppData\Local\Temp\538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe
  "C:\Users\Admin\AppData\Local\Temp\538b16e9cf0d0c6e8ab57ccbf7cc8457164615fb47cdf2e17278a635a9de36c7.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-58-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1304-59-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1304-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1304-61-0x000000000041D3D0-mapping.dmp

Download
memory/1304-62-0x0000000000910000-0x0000000000C13000-memory.dmp

Filesize
3.0MB

Download
memory/1880-53-0x00000000000A0000-0x000000000015A000-memory.dmp

Filesize
744KB

Download
memory/1880-54-0x00000000000A0000-0x000000000015A000-memory.dmp

Filesize
744KB

Download
memory/1880-55-0x0000000004C40000-0x0000000004C41000-memory.dmp

Filesize
4KB

Download
memory/1880-56-0x00000000006C0000-0x00000000006CE000-memory.dmp

Filesize
56KB

Download
memory/1880-57-0x0000000004540000-0x000000000459E000-memory.dmp

Filesize
376KB

Download