xloader | e789763966dffd326114e10b489f2a3b981ccd11f189028704dbbd9a10d33823

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
29-03-2022 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05443965844c3f519abe3ac6427f2bb4.exe
Size

1007KB
MD5

05443965844c3f519abe3ac6427f2bb4
SHA1

e78758a72372214c0de08966c77a50cdbaf3559b
SHA256

e789763966dffd326114e10b489f2a3b981ccd11f189028704dbbd9a10d33823
SHA512

0763351b8e4495ecae3b67bc27279db647eb3adb5e7e5a68a1046526def81f0eb9efd1039cb59b586aa621003f0f9af7c2b121032b4ffc02b36170f06dce113f

Score

10^/10

xloader ahc8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2320-140-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

05443965844c3f519abe3ac6427f2bb4.exe

description pid process target process

PID 2544 set thread context of 2320 2544 05443965844c3f519abe3ac6427f2bb4.exe 05443965844c3f519abe3ac6427f2bb4.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

05443965844c3f519abe3ac6427f2bb4.exe

pid process

2320 05443965844c3f519abe3ac6427f2bb4.exe
2320 05443965844c3f519abe3ac6427f2bb4.exe

description	pid	process	target process
PID 2544 set thread context of 2320	2544	05443965844c3f519abe3ac6427f2bb4.exe	05443965844c3f519abe3ac6427f2bb4.exe

pid	process
2320	05443965844c3f519abe3ac6427f2bb4.exe
2320	05443965844c3f519abe3ac6427f2bb4.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

05443965844c3f519abe3ac6427f2bb4.exe

description	pid	process	target process
PID 2544 wrote to memory of 2320	2544	05443965844c3f519abe3ac6427f2bb4.exe	05443965844c3f519abe3ac6427f2bb4.exe
PID 2544 wrote to memory of 2320	2544	05443965844c3f519abe3ac6427f2bb4.exe	05443965844c3f519abe3ac6427f2bb4.exe
PID 2544 wrote to memory of 2320	2544	05443965844c3f519abe3ac6427f2bb4.exe	05443965844c3f519abe3ac6427f2bb4.exe
PID 2544 wrote to memory of 2320	2544	05443965844c3f519abe3ac6427f2bb4.exe	05443965844c3f519abe3ac6427f2bb4.exe
PID 2544 wrote to memory of 2320	2544	05443965844c3f519abe3ac6427f2bb4.exe	05443965844c3f519abe3ac6427f2bb4.exe
PID 2544 wrote to memory of 2320	2544	05443965844c3f519abe3ac6427f2bb4.exe	05443965844c3f519abe3ac6427f2bb4.exe

C:\Users\Admin\AppData\Local\Temp\05443965844c3f519abe3ac6427f2bb4.exe
"C:\Users\Admin\AppData\Local\Temp\05443965844c3f519abe3ac6427f2bb4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2544

C:\Users\Admin\AppData\Local\Temp\05443965844c3f519abe3ac6427f2bb4.exe
"C:\Users\Admin\AppData\Local\Temp\05443965844c3f519abe3ac6427f2bb4.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2320-139-0x0000000000000000-mapping.dmp

Download
memory/2320-140-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2320-141-0x00000000012B0000-0x00000000015FA000-memory.dmp

Filesize
3.3MB

Download
memory/2544-134-0x0000000000280000-0x0000000000382000-memory.dmp

Filesize
1.0MB

Download
memory/2544-135-0x00000000053A0000-0x0000000005944000-memory.dmp

Filesize
5.6MB

Download
memory/2544-136-0x0000000004D20000-0x0000000004DB2000-memory.dmp

Filesize
584KB

Download
memory/2544-137-0x0000000004DD0000-0x0000000004DDA000-memory.dmp

Filesize
40KB

Download
memory/2544-138-0x00000000084B0000-0x000000000854C000-memory.dmp

Filesize
624KB

Download