xloader | 7a7e0f16c71d3934e048397686fcb78781c77db16bf0b2f8852a38898d2aecee

Analysis

max time kernel
60s
max time network
55s
platform
windows10-1703_x64
resource
win10-20220722-en
resource tags

arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system
submitted
04-08-2022 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
Size

556KB
MD5

a505757fb36d0c2945985135b1de90cb
SHA1

0f90b28aa225725493ef72a9915bf0c5082ff992
SHA256

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601
SHA512

37d993fcb3774673a840d4e13e768c7160120c04746972f8efed6c4687e9872fcc175849193510190fbc5047ce89abcce5c3457955b85e7912c09c12b1f0f011

Score

10^/10

xloader r007 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

r007

Decoy

trashpandaservice.com

mobileads.network

ascolstore.com

gelsinextra.com

bonestell.net

heitoll.xyz

ceapgis.com

mon-lapin.biz

miq-eva.com

rematedesillas.com

playingonline.xyz

hausense.quest

tnyzw.com

appsdial.com

addcolor.city

hagenoblog.com

michaelwesleyj.com

she-zain.com

lorhsems.com

karmaserena.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1408-197-0x0000000000400000-0x000000000042A000-memory.dmp	xloader
behavioral2/memory/1408-198-0x000000000041D9B0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

description	pid	process	target process
PID 2764 set thread context of 1408	2764	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

pid	process
1408	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
1408	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

description	pid	process	target process
PID 2764 wrote to memory of 1408	2764	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2764 wrote to memory of 1408	2764	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2764 wrote to memory of 1408	2764	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2764 wrote to memory of 1408	2764	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2764 wrote to memory of 1408	2764	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2764 wrote to memory of 1408	2764	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
"C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2764

C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
"C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1408-197-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1408-198-0x000000000041D9B0-mapping.dmp

Download
memory/1408-199-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/1408-200-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/1408-201-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/1408-205-0x0000000001240000-0x0000000001560000-memory.dmp

Filesize
3.1MB

Download
memory/2764-160-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-133-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-130-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-131-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-132-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-163-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-134-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-135-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-136-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-137-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-164-0x00000000055B0000-0x0000000005AAE000-memory.dmp

Filesize
5.0MB

Download
memory/2764-139-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-140-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-141-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-142-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-143-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-144-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-145-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-146-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-147-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-148-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-149-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-150-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-151-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-152-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-153-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-154-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-155-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-156-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-162-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-158-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-159-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-128-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-161-0x0000000000710000-0x00000000007A0000-memory.dmp

Filesize
576KB

Download
memory/2764-157-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-129-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-138-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-165-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-166-0x00000000050B0000-0x0000000005142000-memory.dmp

Filesize
584KB

Download
memory/2764-167-0x0000000005150000-0x00000000051EC000-memory.dmp

Filesize
624KB

Download
memory/2764-168-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-169-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-170-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-171-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-172-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-173-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-174-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-175-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-176-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-177-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-178-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-179-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-180-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-181-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-182-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-183-0x0000000005200000-0x000000000520A000-memory.dmp

Filesize
40KB

Download
memory/2764-184-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-185-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-186-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-187-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-188-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-189-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-190-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-191-0x0000000007410000-0x0000000007488000-memory.dmp

Filesize
480KB

Download
memory/2764-127-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-192-0x00000000052C0000-0x00000000052CA000-memory.dmp

Filesize
40KB

Download
memory/2764-193-0x0000000077630000-0x00000000777BE000-memory.dmp

Filesize
1.6MB

Download
memory/2764-194-0x0000000007940000-0x00000000079C2000-memory.dmp

Filesize
520KB

Download
memory/2764-195-0x0000000007A60000-0x0000000007AC6000-memory.dmp

Filesize
408KB

Download
memory/2764-196-0x0000000007A00000-0x0000000007A30000-memory.dmp

Filesize
192KB

Download