xloader | d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7

Analysis

max time kernel
138s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
Size

422KB
MD5

7904b25e05ab4a27857e1f5a30138149
SHA1

19bc6484ad915f83880f05d1c390ae6f5bbaeccf
SHA256

d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7
SHA512

542a99eaa15983e1876b8bc8766af4d6ad5fdbadb76e67b942ddb25602f9378fae0712a6ef3971afd197ff76c124bbd7bd66e4b0744a9b8770f786a55e83b1f6
SSDEEP

12288:DkVmRzvFXkNaYiG8LLzhXPKF3fDf5gdyC18d5hLtyTA:QVEJXcTiHXVM7fEyC18iTA

Score

10^/10

xloader uidr loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

uidr

Decoy

dulichsongcham.com

cash-royal.com

geneseewildlifetrapping.com

9cc9x79m3y2.com

ntjjzx.com

joinglooko.com

upmchealhtrak.com

hookandcask.com

orca-web.com

ag3holdings.com

empoweredinvestmentstx.com

lustywall.com

rcpelaurentides.com

goyalcoorchidnirvanatwo.homes

iotajinn.com

littlemlive.com

hippocratesbio.com

ashleysema.design

175a45.xyz

bpocompaniesphilippines.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4036-139-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

description	pid	process	target process
PID 3172 set thread context of 4036	3172	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exed58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

pid	process
3172	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
3172	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
4036	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
4036	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

description pid process

Token: SeDebugPrivilege 3172 d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

description	pid	process
Token: SeDebugPrivilege	3172	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

description	pid	process	target process
PID 3172 wrote to memory of 1856	3172	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 3172 wrote to memory of 1856	3172	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 3172 wrote to memory of 1856	3172	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 3172 wrote to memory of 4036	3172	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 3172 wrote to memory of 4036	3172	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 3172 wrote to memory of 4036	3172	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 3172 wrote to memory of 4036	3172	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 3172 wrote to memory of 4036	3172	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 3172 wrote to memory of 4036	3172	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

C:\Users\Admin\AppData\Local\Temp\d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
"C:\Users\Admin\AppData\Local\Temp\d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172

C:\Users\Admin\AppData\Local\Temp\d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
"C:\Users\Admin\AppData\Local\Temp\d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe"
2⤵
PID:1856

C:\Users\Admin\AppData\Local\Temp\d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
"C:\Users\Admin\AppData\Local\Temp\d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4036

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1856-137-0x0000000000000000-mapping.dmp

Download
memory/3172-132-0x0000000000D80000-0x0000000000DF0000-memory.dmp

Filesize
448KB

Download
memory/3172-133-0x0000000005BE0000-0x0000000006184000-memory.dmp

Filesize
5.6MB

Download
memory/3172-134-0x00000000056D0000-0x0000000005762000-memory.dmp

Filesize
584KB

Download
memory/3172-135-0x0000000005770000-0x000000000580C000-memory.dmp

Filesize
624KB

Download
memory/3172-136-0x0000000005660000-0x000000000566A000-memory.dmp

Filesize
40KB

Download
memory/4036-138-0x0000000000000000-mapping.dmp

Download
memory/4036-139-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4036-140-0x0000000001A20000-0x0000000001D6A000-memory.dmp

Filesize
3.3MB

Download