xloader | 7a7e0f16c71d3934e048397686fcb78781c77db16bf0b2f8852a38898d2aecee

Analysis

max time kernel
50s
max time network
49s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
04-08-2022 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
Size

556KB
MD5

a505757fb36d0c2945985135b1de90cb
SHA1

0f90b28aa225725493ef72a9915bf0c5082ff992
SHA256

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601
SHA512

37d993fcb3774673a840d4e13e768c7160120c04746972f8efed6c4687e9872fcc175849193510190fbc5047ce89abcce5c3457955b85e7912c09c12b1f0f011

Score

10^/10

xloader r007 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

r007

Decoy

trashpandaservice.com

mobileads.network

ascolstore.com

gelsinextra.com

bonestell.net

heitoll.xyz

ceapgis.com

mon-lapin.biz

miq-eva.com

rematedesillas.com

playingonline.xyz

hausense.quest

tnyzw.com

appsdial.com

addcolor.city

hagenoblog.com

michaelwesleyj.com

she-zain.com

lorhsems.com

karmaserena.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1372-63-0x0000000000400000-0x000000000042A000-memory.dmp	xloader
behavioral1/memory/1372-64-0x000000000041D9B0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

description	pid	process	target process
PID 976 set thread context of 1372	976	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

pid process

1372 13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

pid	process
1372	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

description	pid	process	target process
PID 976 wrote to memory of 1372	976	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 976 wrote to memory of 1372	976	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 976 wrote to memory of 1372	976	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 976 wrote to memory of 1372	976	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 976 wrote to memory of 1372	976	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 976 wrote to memory of 1372	976	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 976 wrote to memory of 1372	976	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
"C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:976

C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
"C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1372

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/976-54-0x0000000000EF0000-0x0000000000F80000-memory.dmp

Filesize
576KB

Download
memory/976-55-0x0000000076631000-0x0000000076633000-memory.dmp

Filesize
8KB

Download
memory/976-56-0x0000000000E70000-0x0000000000EE8000-memory.dmp

Filesize
480KB

Download
memory/976-57-0x0000000000250000-0x000000000025A000-memory.dmp

Filesize
40KB

Download
memory/976-58-0x0000000005330000-0x00000000053B2000-memory.dmp

Filesize
520KB

Download
memory/976-59-0x0000000000670000-0x00000000006A0000-memory.dmp

Filesize
192KB

Download
memory/1372-60-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1372-61-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1372-63-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1372-64-0x000000000041D9B0-mapping.dmp

Download
memory/1372-65-0x0000000000950000-0x0000000000C53000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads