xloader | fe55fb664c32bacbd76bf8859a8a2cd17f23d21f08a22ac9881cb0fa33935990

Analysis

max time kernel
91s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
19-05-2022 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27fe38ce70fca4c4526c07a42449f11e.exe
Size

260KB
MD5

27fe38ce70fca4c4526c07a42449f11e
SHA1

cd9243f1b525d08290f1bb2c428235a40e0a423e
SHA256

fe55fb664c32bacbd76bf8859a8a2cd17f23d21f08a22ac9881cb0fa33935990
SHA512

d68a45d7c19e2a13da3e68b17823578e4e0cd17e949931b90d1fb211ffee3d46f90acf28e1b93b76435c6f8c5da4050150e993c8e7d6a4d5af5114702d155d80

Score

10^/10

xloader be4o loader rat

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

be4o

Decoy

laboratoriobioixcha.com

tictocperushop.online

wild-oceans.com

belaruscountry.com

kicktmall.com

fitcoinweb.tech

mores.one

gogear.one

gxrcksy.com

samrcq.com

impossible-icecream.com

bravesxx.com

bookchainart.com

sleepsolutionsofmboro.com

ocbrazilbusinessclub.com

advisor76.xyz

xitaotech.com

mgsdtytifgf3414.xyz

johnson-brown.net

cr3drt.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4380-134-0x0000000000620000-0x000000000064B000-memory.dmp	xloader

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

27fe38ce70fca4c4526c07a42449f11e.exe

description pid process target process

PID 4968 set thread context of 4380 4968 27fe38ce70fca4c4526c07a42449f11e.exe vbc.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2036 4380 WerFault.exe vbc.exe

description	pid	process	target process
PID 4968 set thread context of 4380	4968	27fe38ce70fca4c4526c07a42449f11e.exe	vbc.exe

pid	pid_target	process	target process
2036	4380	WerFault.exe	vbc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

27fe38ce70fca4c4526c07a42449f11e.exe

description	pid	process	target process
PID 4968 wrote to memory of 4380	4968	27fe38ce70fca4c4526c07a42449f11e.exe	vbc.exe
PID 4968 wrote to memory of 4380	4968	27fe38ce70fca4c4526c07a42449f11e.exe	vbc.exe
PID 4968 wrote to memory of 4380	4968	27fe38ce70fca4c4526c07a42449f11e.exe	vbc.exe
PID 4968 wrote to memory of 4380	4968	27fe38ce70fca4c4526c07a42449f11e.exe	vbc.exe
PID 4968 wrote to memory of 4380	4968	27fe38ce70fca4c4526c07a42449f11e.exe	vbc.exe
PID 4968 wrote to memory of 4380	4968	27fe38ce70fca4c4526c07a42449f11e.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\27fe38ce70fca4c4526c07a42449f11e.exe
"C:\Users\Admin\AppData\Local\Temp\27fe38ce70fca4c4526c07a42449f11e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 184
3⤵
- Program crash
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4380 -ip 4380
1⤵
PID:3176

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4380-132-0x0000000000000000-mapping.dmp

Download
memory/4380-134-0x0000000000620000-0x000000000064B000-memory.dmp

Filesize
172KB

Download
memory/4968-130-0x0000000000C00000-0x0000000000C46000-memory.dmp

Filesize
280KB

Download
memory/4968-131-0x0000000005AB0000-0x0000000006054000-memory.dmp

Filesize
5.6MB

Download