xloader | f469b5c967ff28b96444a48b6769ccde102417de9d59df1878bfe486ade890dd

Analysis

max time kernel
127s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
04-04-2022 18:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

931453d79c93683fde7164517bd256f8.exe
Size

606KB
MD5

931453d79c93683fde7164517bd256f8
SHA1

aad71309d2e5ae52e9a80d108ff888f11735454b
SHA256

f469b5c967ff28b96444a48b6769ccde102417de9d59df1878bfe486ade890dd
SHA512

953b2b0bd9cf3fc210a6591b75420ce64d58d4220f60fa7d31e436240fdc71768ffabd4f39b58f1e8230b3f29c24c8bfe0809c32f7b5b50aa95f7420706c1f3f

Score

10^/10

xloader ahc8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4916-137-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

931453d79c93683fde7164517bd256f8.exe

description pid process target process

PID 2772 set thread context of 4916 2772 931453d79c93683fde7164517bd256f8.exe 931453d79c93683fde7164517bd256f8.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

931453d79c93683fde7164517bd256f8.exe

pid process

4916 931453d79c93683fde7164517bd256f8.exe
4916 931453d79c93683fde7164517bd256f8.exe

description	pid	process	target process
PID 2772 set thread context of 4916	2772	931453d79c93683fde7164517bd256f8.exe	931453d79c93683fde7164517bd256f8.exe

pid	process
4916	931453d79c93683fde7164517bd256f8.exe
4916	931453d79c93683fde7164517bd256f8.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

931453d79c93683fde7164517bd256f8.exe

description	pid	process	target process
PID 2772 wrote to memory of 4916	2772	931453d79c93683fde7164517bd256f8.exe	931453d79c93683fde7164517bd256f8.exe
PID 2772 wrote to memory of 4916	2772	931453d79c93683fde7164517bd256f8.exe	931453d79c93683fde7164517bd256f8.exe
PID 2772 wrote to memory of 4916	2772	931453d79c93683fde7164517bd256f8.exe	931453d79c93683fde7164517bd256f8.exe
PID 2772 wrote to memory of 4916	2772	931453d79c93683fde7164517bd256f8.exe	931453d79c93683fde7164517bd256f8.exe
PID 2772 wrote to memory of 4916	2772	931453d79c93683fde7164517bd256f8.exe	931453d79c93683fde7164517bd256f8.exe
PID 2772 wrote to memory of 4916	2772	931453d79c93683fde7164517bd256f8.exe	931453d79c93683fde7164517bd256f8.exe

C:\Users\Admin\AppData\Local\Temp\931453d79c93683fde7164517bd256f8.exe
"C:\Users\Admin\AppData\Local\Temp\931453d79c93683fde7164517bd256f8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2772

C:\Users\Admin\AppData\Local\Temp\931453d79c93683fde7164517bd256f8.exe
"C:\Users\Admin\AppData\Local\Temp\931453d79c93683fde7164517bd256f8.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2772-130-0x0000000000190000-0x000000000022C000-memory.dmp

Filesize
624KB

Download
memory/2772-131-0x00000000052E0000-0x0000000005884000-memory.dmp

Filesize
5.6MB

Download
memory/2772-132-0x0000000004C10000-0x0000000004CA2000-memory.dmp

Filesize
584KB

Download
memory/2772-133-0x0000000004BE0000-0x0000000004BEA000-memory.dmp

Filesize
40KB

Download
memory/2772-134-0x000000000A0A0000-0x000000000A13C000-memory.dmp

Filesize
624KB

Download
memory/2772-135-0x000000000A320000-0x000000000A386000-memory.dmp

Filesize
408KB

Download
memory/4916-136-0x0000000000000000-mapping.dmp

Download
memory/4916-137-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4916-138-0x0000000001120000-0x000000000146A000-memory.dmp

Filesize
3.3MB

Download