xloader | c8781b8dca56fa093b3df95c16360b2dc381eadb10b4f9055e11b39f34284749

Analysis

max time kernel
135s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
14-03-2022 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f623f7aab4fc4b985783241478917d0.exe
Size

930KB
MD5

4f623f7aab4fc4b985783241478917d0
SHA1

e6d98b26140257c7214e113f2c2143de4f22a453
SHA256

c8781b8dca56fa093b3df95c16360b2dc381eadb10b4f9055e11b39f34284749
SHA512

d6487c4395521cd8a1590c7c4a9bb8ab28c69b39a6fd2dfba90e4f13e5b471ca3c0621ee6f1c14c7f6d718b2d6228dbb0142bcdb12ca3b32f097670b8f65ee61

Score

10^/10

xloader ahc8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3664-141-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

4f623f7aab4fc4b985783241478917d0.exe

description pid process target process

PID 4884 set thread context of 3664 4884 4f623f7aab4fc4b985783241478917d0.exe 4f623f7aab4fc4b985783241478917d0.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4f623f7aab4fc4b985783241478917d0.exe

pid process

3664 4f623f7aab4fc4b985783241478917d0.exe
3664 4f623f7aab4fc4b985783241478917d0.exe

description	pid	process	target process
PID 4884 set thread context of 3664	4884	4f623f7aab4fc4b985783241478917d0.exe	4f623f7aab4fc4b985783241478917d0.exe

pid	process
3664	4f623f7aab4fc4b985783241478917d0.exe
3664	4f623f7aab4fc4b985783241478917d0.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4f623f7aab4fc4b985783241478917d0.exe

description	pid	process	target process
PID 4884 wrote to memory of 3664	4884	4f623f7aab4fc4b985783241478917d0.exe	4f623f7aab4fc4b985783241478917d0.exe
PID 4884 wrote to memory of 3664	4884	4f623f7aab4fc4b985783241478917d0.exe	4f623f7aab4fc4b985783241478917d0.exe
PID 4884 wrote to memory of 3664	4884	4f623f7aab4fc4b985783241478917d0.exe	4f623f7aab4fc4b985783241478917d0.exe
PID 4884 wrote to memory of 3664	4884	4f623f7aab4fc4b985783241478917d0.exe	4f623f7aab4fc4b985783241478917d0.exe
PID 4884 wrote to memory of 3664	4884	4f623f7aab4fc4b985783241478917d0.exe	4f623f7aab4fc4b985783241478917d0.exe
PID 4884 wrote to memory of 3664	4884	4f623f7aab4fc4b985783241478917d0.exe	4f623f7aab4fc4b985783241478917d0.exe

C:\Users\Admin\AppData\Local\Temp\4f623f7aab4fc4b985783241478917d0.exe
"C:\Users\Admin\AppData\Local\Temp\4f623f7aab4fc4b985783241478917d0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4884

C:\Users\Admin\AppData\Local\Temp\4f623f7aab4fc4b985783241478917d0.exe
"C:\Users\Admin\AppData\Local\Temp\4f623f7aab4fc4b985783241478917d0.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3664-141-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3664-142-0x0000000001150000-0x000000000149A000-memory.dmp

Filesize
3.3MB

Download
memory/4884-134-0x0000000074CF0000-0x00000000754A0000-memory.dmp

Filesize
7.7MB

Download
memory/4884-135-0x0000000000EA0000-0x0000000000F8E000-memory.dmp

Filesize
952KB

Download
memory/4884-136-0x0000000005E40000-0x00000000063E4000-memory.dmp

Filesize
5.6MB

Download
memory/4884-137-0x0000000005940000-0x00000000059D2000-memory.dmp

Filesize
584KB

Download
memory/4884-138-0x0000000005890000-0x0000000005E34000-memory.dmp

Filesize
5.6MB

Download
memory/4884-139-0x0000000005AD0000-0x0000000005ADA000-memory.dmp

Filesize
40KB

Download
memory/4884-140-0x0000000001580000-0x000000000161C000-memory.dmp

Filesize
624KB

Download