xloader | cd8eba06bb4896fa2e84a9f8e9577e027a9e77fedbb5182326d942dee66b7067

Analysis

max time kernel
72s
max time network
47s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
26/07/2022, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.W32.AIDetectNet.01.10589.exe
Size 1.1MB
Sample220726-ptgk2ache8
SHA256 cd8eba06bb4896fa2e84a9f8e9577e027a9e77fedbb5182326d942dee66b7067
MD5 7e5e67c6e398af34f1cdb8c5133ed8dc
SHA1 f515949e0d84442593c56c1b519e476b3f1ba56c
SHA512 f958544e6aec9bc3b512396fd27e96fffaaed9a6ee5050770188a48d0eebc995bb1ac2f20fdc68a49f37f7a8f63ae08a4ee0c0724b00d2e6d9b1378eff8a4f9d
MD5 SHA1 SHA512

Score

10^/10

xloader g6k0 loader rat

Malware Config

Extracted

Family

xloader

Version

Campaign

g6k0

Decoy

acquarg.com
prayforthehorn.com
pocketbookwhack.com
easeaging.com
hofu-hinomarutaxi.com
jonesconcreteornamentals.com
mvcfxbo.com
jpfinancial.partners
bgstudio.online
jfxpm.xyz
amigoviajero.com
vrrrd.com
indianscafe.com
chancecrew.com
westbrookpizzeriany.com
goldetfs.xyz
hrpgoyna.club
yafitexchange.com
fromagerielacotiere.com
trascrss.com
asiarealty.xyz
reactorcave.store
handmadebytn.com
pillargrease.online
haoting.online
proscapelive.com
bsdaun.com
codewithnavi.com
4g-soft.com
cmmt4.com
julegaming.com
restoreautoservice.com
lovabull.biz
welcomehomenewhaven.com
whiskyband.com
livelongandprosper.world
vicinityenergy.co
telenet-cloud.com
rincontreslagunas.com
bewaehrungshilfe.com
jatmatrimony.net
lifecoachingacademy.xyz
nwwhites.com
chainfs.online
pikettrans.com
whaleswap.finance
ictconfestonia.com
porterzrh.com
developerspecialist.com
cringbot.xyz
casa-habitada.com
lyloux.com
anfairlace.com
aternet.cloud
hl273.com
bestrbsunglasses.com
virginitymatters.com
st-louis-photographer.com
qbcha.net
metataylormade.net
gelalogs.com
3jaib.net
aphisambitabay.com
randrdrystock.com
redpurebeauty.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/1704-63-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral1/memory/1704-64-0x000000000041F290-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 1704	1732	SecuriteInfo.com.W32.AIDetectNet.01.10589.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1704	SecuriteInfo.com.W32.AIDetectNet.01.10589.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1704	1732	SecuriteInfo.com.W32.AIDetectNet.01.10589.exe	28
PID 1732 wrote to memory of 1704	1732	SecuriteInfo.com.W32.AIDetectNet.01.10589.exe	28
PID 1732 wrote to memory of 1704	1732	SecuriteInfo.com.W32.AIDetectNet.01.10589.exe	28
PID 1732 wrote to memory of 1704	1732	SecuriteInfo.com.W32.AIDetectNet.01.10589.exe	28
PID 1732 wrote to memory of 1704	1732	SecuriteInfo.com.W32.AIDetectNet.01.10589.exe	28
PID 1732 wrote to memory of 1704	1732	SecuriteInfo.com.W32.AIDetectNet.01.10589.exe	28
PID 1732 wrote to memory of 1704	1732	SecuriteInfo.com.W32.AIDetectNet.01.10589.exe	28

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.10589.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.10589.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.10589.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.10589.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-60-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1704-61-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1704-63-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1704-65-0x0000000000B80000-0x0000000000E83000-memory.dmp

Download

memory/1732-54-0x0000000000A60000-0x0000000000B80000-memory.dmp

Download

memory/1732-55-0x0000000075271000-0x0000000075273000-memory.dmp

Download

memory/1732-56-0x00000000003D0000-0x00000000003E6000-memory.dmp

Download

memory/1732-57-0x0000000000360000-0x000000000036A000-memory.dmp

Download

memory/1732-58-0x0000000004FD0000-0x0000000005056000-memory.dmp

Download

memory/1732-59-0x0000000000750000-0x0000000000788000-memory.dmp

Download