xloader | dcfa4dfcc90ae3c90deb36709bdaed5a1d49a174139bf814cd758ed8b6859c1a

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
13-06-2022 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.W32.AIDetectNet.01.4418.exe
Size

453KB
MD5

38582ab77e044f76e4f802fd56a0273f
SHA1

cfc9d39c4a5e5d61d15a4eab30f2d32ec1545728
SHA256

dcfa4dfcc90ae3c90deb36709bdaed5a1d49a174139bf814cd758ed8b6859c1a
SHA512

8bb21e3d17771127b21a9cdf1e433f460cd1d9d14029c59e318b429ee8da390716c034cf5ecc1410c895ac5e8159a8be7fd9f51e95e8582a060be4f02e19da1a

Score

10^/10

xloader be3s loader rat

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

be3s

Decoy

aoxaswa.info

souplab-graphic.com

churchontheisland.com

spclassic-cars.com

stanford-edu.club

heydowm.online

chattanooga-electricians.com

sectsk.com

cxg98.com

buildafricaonline.net

buydogcoin.com

vsst247.com

lodgelastrancas.com

ainonaho.com

griousndwarehsftyfs.xyz

voltagestabilizersupply.com

xn--79q565dzfex9hg81b.com

isrvr-ccrforum.info

chitiandi.com

criticaldisco.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1504-136-0x0000000000400000-0x000000000042B000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.W32.AIDetectNet.01.4418.exe

description	pid	process	target process
PID 3368 set thread context of 1504	3368	SecuriteInfo.com.W32.AIDetectNet.01.4418.exe	SecuriteInfo.com.W32.AIDetectNet.01.4418.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

SecuriteInfo.com.W32.AIDetectNet.01.4418.exe

pid process

1504 SecuriteInfo.com.W32.AIDetectNet.01.4418.exe
1504 SecuriteInfo.com.W32.AIDetectNet.01.4418.exe

pid	process
1504	SecuriteInfo.com.W32.AIDetectNet.01.4418.exe
1504	SecuriteInfo.com.W32.AIDetectNet.01.4418.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

SecuriteInfo.com.W32.AIDetectNet.01.4418.exe

description	pid	process	target process
PID 3368 wrote to memory of 1504	3368	SecuriteInfo.com.W32.AIDetectNet.01.4418.exe	SecuriteInfo.com.W32.AIDetectNet.01.4418.exe
PID 3368 wrote to memory of 1504	3368	SecuriteInfo.com.W32.AIDetectNet.01.4418.exe	SecuriteInfo.com.W32.AIDetectNet.01.4418.exe
PID 3368 wrote to memory of 1504	3368	SecuriteInfo.com.W32.AIDetectNet.01.4418.exe	SecuriteInfo.com.W32.AIDetectNet.01.4418.exe
PID 3368 wrote to memory of 1504	3368	SecuriteInfo.com.W32.AIDetectNet.01.4418.exe	SecuriteInfo.com.W32.AIDetectNet.01.4418.exe
PID 3368 wrote to memory of 1504	3368	SecuriteInfo.com.W32.AIDetectNet.01.4418.exe	SecuriteInfo.com.W32.AIDetectNet.01.4418.exe
PID 3368 wrote to memory of 1504	3368	SecuriteInfo.com.W32.AIDetectNet.01.4418.exe	SecuriteInfo.com.W32.AIDetectNet.01.4418.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.4418.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.4418.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3368

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.4418.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.4418.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-135-0x0000000000000000-mapping.dmp

Download
memory/1504-136-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1504-137-0x0000000001460000-0x00000000017AA000-memory.dmp

Filesize
3.3MB

Download
memory/3368-130-0x00000000006B0000-0x0000000000726000-memory.dmp

Filesize
472KB

Download
memory/3368-131-0x0000000005600000-0x0000000005BA4000-memory.dmp

Filesize
5.6MB

Download
memory/3368-132-0x00000000050F0000-0x0000000005182000-memory.dmp

Filesize
584KB

Download
memory/3368-133-0x00000000050E0000-0x00000000050EA000-memory.dmp

Filesize
40KB

Download
memory/3368-134-0x0000000007A60000-0x0000000007AFC000-memory.dmp

Filesize
624KB

Download