xloader | d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2

Analysis

max time kernel
103s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe
Size

984KB
MD5

1451fb0f3e10bfec2ff424da9147c75e
SHA1

1f8e0881fad737fc59d900c53d46ccc937ccdf3a
SHA256

d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2
SHA512

51786f8ef1b6877b872ae2c7e564b52ea731cefef3e037b1b56cc4a363dbf602bfa455d17c09b6c1d9e15e11e11a7e149e885b87ef9c203cbd4aac603e32bf8d
SSDEEP

12288:OWW3hkl/81RWR+5eJ0rGqvcRSvYRPyZVSBWeFkTxv39:ikl0DxeJyGh4YRPLFkJ9

Score

10^/10

xloader e68n loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

e68n

Decoy

ds3i.com

integrityconnect.info

jhpaolilo.com

aprilgraberphotography.com

globe-gist.com

blackwellheatingandcooling.com

gossgoddard.com

memoriesmade-l.com

ozsmiwd.icu

pelzerforcongress.com

infinitybytg.com

gczp22.com

logonanet.com

998899sj.com

xn--vhqqb859burbuz7jebh.com

savorysinsation.com

cumykuf.icu

ourbella.com

isurfkarma.com

thepostmail.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/1232-56-0x0000000000390000-0x0000000000398000-memory.dmp	CustAttr

Xloader payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1500-61-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/1500-62-0x000000000041CFC0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe

description	pid	process	target process
PID 1232 set thread context of 1500	1232	d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe	d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe

pid process

1500 d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe

pid	process
1500	d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe

description	pid	process	target process
PID 1232 wrote to memory of 1500	1232	d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe	d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe
PID 1232 wrote to memory of 1500	1232	d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe	d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe
PID 1232 wrote to memory of 1500	1232	d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe	d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe
PID 1232 wrote to memory of 1500	1232	d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe	d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe
PID 1232 wrote to memory of 1500	1232	d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe	d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe
PID 1232 wrote to memory of 1500	1232	d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe	d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe
PID 1232 wrote to memory of 1500	1232	d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe	d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe

C:\Users\Admin\AppData\Local\Temp\d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe
"C:\Users\Admin\AppData\Local\Temp\d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1232

C:\Users\Admin\AppData\Local\Temp\d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe
"C:\Users\Admin\AppData\Local\Temp\d73dfe16ee1bc567ce32a408839c9074509ad6cc1e21fd710f7a9f97a5d623e2.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1500

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-54-0x00000000012A0000-0x000000000139C000-memory.dmp

Filesize
1008KB

Download
memory/1232-55-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/1232-56-0x0000000000390000-0x0000000000398000-memory.dmp

Filesize
32KB

Download
memory/1232-57-0x0000000001250000-0x00000000012A6000-memory.dmp

Filesize
344KB

Download
memory/1500-58-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1500-59-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1500-61-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1500-62-0x000000000041CFC0-mapping.dmp

Download
memory/1500-63-0x00000000008D0000-0x0000000000BD3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads