xloader | 7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421

Analysis

max time kernel
123s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
Size

966KB
MD5

c0333ad2c54dbeaa683f72272f7cdb9e
SHA1

6b83bdd574eec43323edbe989f631bbe995f4e03
SHA256

7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421
SHA512

02b6cca699f30c0f049f572150a5ebc1361ed020cd0aa9884d2e87ac90a2d362a5aed04e1a687d30a43fbf34754b14f56e999f39b60da7155f62f828e4004fe0
SSDEEP

12288:ApRCK127BZddxiQZxXapnl/DAr52S1rKgU19Mx+TYW/l0RLq2W3/T:ADCNR8DXScgU19MxbW/GEPT

Score

10^/10

xloader ur06 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ur06

Decoy

philippebrooksdesign.com

cmoorestudio.com

profille-sarina23tammara.club

dqulxe.com

uiffinger.com

nolarapper.com

maconanimalexterminator.com

bisovka.com

loveisloveent.com

datication.com

spxo66.com

drhelpnow.com

ladybug-cle.com

macocome.com

thepoppysocks.com

eldritchparadox.com

mercadolibre.company

ismartfarm.com

kansascarlot.com

kevinld.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/448-135-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe

description	pid	process	target process
PID 5076 set thread context of 448	5076	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe

pid	process
448	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
448	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe

description	pid	process	target process
PID 5076 wrote to memory of 448	5076	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
PID 5076 wrote to memory of 448	5076	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
PID 5076 wrote to memory of 448	5076	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
PID 5076 wrote to memory of 448	5076	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
PID 5076 wrote to memory of 448	5076	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
PID 5076 wrote to memory of 448	5076	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe

C:\Users\Admin\AppData\Local\Temp\7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
"C:\Users\Admin\AppData\Local\Temp\7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5076

C:\Users\Admin\AppData\Local\Temp\7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
"C:\Users\Admin\AppData\Local\Temp\7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/448-134-0x0000000000000000-mapping.dmp

Download
memory/448-135-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/448-136-0x0000000001330000-0x000000000167A000-memory.dmp

Filesize
3.3MB

Download
memory/5076-132-0x0000000074850000-0x0000000074E01000-memory.dmp

Filesize
5.7MB

Download
memory/5076-133-0x0000000074850000-0x0000000074E01000-memory.dmp

Filesize
5.7MB

Download
memory/5076-137-0x0000000074850000-0x0000000074E01000-memory.dmp

Filesize
5.7MB

Download