xloader | 774d7c77607bc7964f40cbe18a7d63c76524fe5af7f6ad09a68fead4c35e9cdb

Analysis

max time kernel
181s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
15/06/2022, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
416a1b448d92aaf4a73eb31cc458a068.exe
Size 434KB
Sample220615-rq9hraagbj
SHA256 774d7c77607bc7964f40cbe18a7d63c76524fe5af7f6ad09a68fead4c35e9cdb
MD5 416a1b448d92aaf4a73eb31cc458a068
SHA1 b5d3833863e9a47548e75bccbc4ac47498b3e650
SHA512 bacbe21970361976382b56b777309361df3fbca5e98ccefce712d964b13810e007777acd286c9f544fa7bcba82f4e3a06bb2626a399b966e75d018a7c1dd1fe4
MD5 SHA1 SHA512

Score

10^/10

xloader poub loader rat

Malware Config

Extracted

Family

xloader

Version

Campaign

poub

Decoy

lawizard24.com
maharudrahousing.com
promocionpe-2022.info
brickcritic.com
memelandnft.xyz
pixieest.com
sayitwithtreats.com
painausucre.com
nirohee.com
iy96.xyz
thearabgoals.com
ticketstogostl.com
impreseadispuliziesit.com
dipucloud.com
huyikm.space
atas99.club
goodie-woodie.com
rulouri-exterioare.com
carobrugs.com
dcprint.online
xc8a3ptjeu145e.xyz
mind-wrap.com
cloverleafsquad.com
binancesignup.net
wslmkj012.top
bensiets.com
gmqitong.com
regalstudios.one
secimasuitca.net
bhrefsre.com
produceautism.com
underground-info.com
thrivemusic.biz
woodmagegypt.com
riegadier.com
osmaesports.com
heynonograms.xyz
banikuher.site
lukaclinic.xyz
plasticsurgeonbot.com
zoux.online
oilexpress-ch.com
xrayresponses.com
jamesloewenbergrealty.com
senhorgames.com
virtualitystore.com
singhsarangi.com
azpvhs.com
snias-digital.com
izumidragon.com
capitalpower.xyz
ishitavishwakarma.com
quitsmokingtips.info
geopriskindex.com
appsallin1.com
avecesescribocartas.com
woodlandsacres.com
xn--meunegcio-b7a.xyz
learnlimited.space
payawaypro.com
seedsoffaithwomen.com
relevate.one
resellersmarket.net
katiekleinart.com
promenadi.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1216-133-0x0000000000411000-0x000000000043B000-memory.dmp	xloader

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 1216	1976	416a1b448d92aaf4a73eb31cc458a068.exe	80

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2360	1216	WerFault.exe	80

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1216	1976	416a1b448d92aaf4a73eb31cc458a068.exe	80
PID 1976 wrote to memory of 1216	1976	416a1b448d92aaf4a73eb31cc458a068.exe	80
PID 1976 wrote to memory of 1216	1976	416a1b448d92aaf4a73eb31cc458a068.exe	80
PID 1976 wrote to memory of 1216	1976	416a1b448d92aaf4a73eb31cc458a068.exe	80
PID 1976 wrote to memory of 1216	1976	416a1b448d92aaf4a73eb31cc458a068.exe	80
PID 1976 wrote to memory of 1216	1976	416a1b448d92aaf4a73eb31cc458a068.exe	80

C:\Users\Admin\AppData\Local\Temp\416a1b448d92aaf4a73eb31cc458a068.exe
"C:\Users\Admin\AppData\Local\Temp\416a1b448d92aaf4a73eb31cc458a068.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 184
    3⤵
    - Program crash
    PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1216 -ip 1216
1⤵
PID:2600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-133-0x0000000000411000-0x000000000043B000-memory.dmp

Download

memory/1976-130-0x0000000000A10000-0x0000000000A84000-memory.dmp