xloader | 13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601

Analysis

max time kernel
156s
max time network
177s
platform
windows10_x64
resource
win10-20220414-en
submitted
16-05-2022 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
Size

556KB
MD5

a505757fb36d0c2945985135b1de90cb
SHA1

0f90b28aa225725493ef72a9915bf0c5082ff992
SHA256

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601
SHA512

37d993fcb3774673a840d4e13e768c7160120c04746972f8efed6c4687e9872fcc175849193510190fbc5047ce89abcce5c3457955b85e7912c09c12b1f0f011

Score

10^/10

xloader r007 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

r007

Decoy

trashpandaservice.com

mobileads.network

ascolstore.com

gelsinextra.com

bonestell.net

heitoll.xyz

ceapgis.com

mon-lapin.biz

miq-eva.com

rematedesillas.com

playingonline.xyz

hausense.quest

tnyzw.com

appsdial.com

addcolor.city

hagenoblog.com

michaelwesleyj.com

she-zain.com

lorhsems.com

karmaserena.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2992-188-0x0000000000400000-0x000000000042A000-memory.dmp	xloader
behavioral1/memory/2992-189-0x000000000041D9B0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

description	pid	process	target process
PID 2644 set thread context of 2992	2644	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

pid	process
2992	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
2992	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

description	pid	process	target process
PID 2644 wrote to memory of 2992	2644	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2644 wrote to memory of 2992	2644	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2644 wrote to memory of 2992	2644	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2644 wrote to memory of 2992	2644	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2644 wrote to memory of 2992	2644	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2644 wrote to memory of 2992	2644	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
"C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2644

C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
"C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2644-118-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-119-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-120-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-121-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-122-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-123-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-124-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-125-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-126-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-127-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-128-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-129-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-130-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-131-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-132-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-133-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-134-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-135-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-136-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-137-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-138-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-139-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-140-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-141-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-142-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-143-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-144-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-145-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-146-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-147-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-148-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-149-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-150-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-151-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-152-0x0000000000B10000-0x0000000000BA0000-memory.dmp

Filesize
576KB

Download
memory/2644-153-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-154-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-155-0x00000000059C0000-0x0000000005EBE000-memory.dmp

Filesize
5.0MB

Download
memory/2644-156-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-157-0x00000000054C0000-0x0000000005552000-memory.dmp

Filesize
584KB

Download
memory/2644-158-0x0000000005560000-0x00000000055FC000-memory.dmp

Filesize
624KB

Download
memory/2644-159-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-160-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-161-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-162-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-163-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-164-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-165-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-166-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-167-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-168-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-169-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-170-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-171-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-172-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-173-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-174-0x00000000053D0000-0x00000000053DA000-memory.dmp

Filesize
40KB

Download
memory/2644-175-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-176-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-177-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-178-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-179-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-180-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-181-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-182-0x0000000007820000-0x0000000007898000-memory.dmp

Filesize
480KB

Download
memory/2644-183-0x0000000005470000-0x000000000547A000-memory.dmp

Filesize
40KB

Download
memory/2644-184-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2644-185-0x00000000013A0000-0x0000000001422000-memory.dmp

Filesize
520KB

Download
memory/2644-186-0x0000000007C50000-0x0000000007CB6000-memory.dmp

Filesize
408KB

Download
memory/2644-187-0x0000000001450000-0x0000000001480000-memory.dmp

Filesize
192KB

Download
memory/2992-188-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2992-190-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2992-189-0x000000000041D9B0-mapping.dmp

Download
memory/2992-191-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2992-192-0x00000000773E0000-0x000000007756E000-memory.dmp

Filesize
1.6MB

Download
memory/2992-196-0x00000000016B0000-0x00000000019D0000-memory.dmp

Filesize
3.1MB

Download