xloader | 7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a

Analysis

max time kernel
88s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
Size

621KB
MD5

79a27708f1ff4dfa461500891bff39e2
SHA1

a517e7a24241a83aebb3f3be2b477cbf1dbe59d3
SHA256

7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a
SHA512

404f6c774fdc15c5aea3e053723be2c2b9cc9e6d3ec0a004c1f3331bbfe9fd8f22008f51535ed9cb705e7797491e682622fba57e43c8d6055c26896867f30e8e
SSDEEP

12288:JxTE6jCfk3q75Iqjf7rYmfwzxIf3RAKsXQHHc5n6rovf8WlPlD:JxvCZdIKfbIzxIf3RAK0QKF0WldD

Score

10^/10

xloader uszn loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

uszn

Decoy

animegriptape.com

pcpnetworks.com

putupmybabyforadoption.com

xn--jvrr98g37n88d.com

fertinvitro.doctor

undonethread.com

avoleague.com

sissysundays.com

guilhermeoliveiro.site

catholicon-bespeckle.info

mardesuenosfundacion.com

songkhoe24.site

shoecityindia.com

smallbathroomdecor.info

tskusa.com

prairiespringsllc.com

kegncoffee.com

clicklounge.xyz

catholicendoflifeplanning.com

steelobzee.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/780-61-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/780-62-0x000000000041D0F0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

description	pid	process	target process
PID 1104 set thread context of 780	1104	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

pid	process
1104	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
780	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

description pid process

Token: SeDebugPrivilege 1104 7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

description	pid	process
Token: SeDebugPrivilege	1104	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

description	pid	process	target process
PID 1104 wrote to memory of 780	1104	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
PID 1104 wrote to memory of 780	1104	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
PID 1104 wrote to memory of 780	1104	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
PID 1104 wrote to memory of 780	1104	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
PID 1104 wrote to memory of 780	1104	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
PID 1104 wrote to memory of 780	1104	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
PID 1104 wrote to memory of 780	1104	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

C:\Users\Admin\AppData\Local\Temp\7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
"C:\Users\Admin\AppData\Local\Temp\7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104

C:\Users\Admin\AppData\Local\Temp\7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:780

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-58-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/780-59-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/780-61-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/780-62-0x000000000041D0F0-mapping.dmp

Download
memory/780-63-0x0000000000870000-0x0000000000B73000-memory.dmp

Filesize
3.0MB

Download
memory/1104-54-0x0000000000BC0000-0x0000000000C60000-memory.dmp

Filesize
640KB

Download
memory/1104-55-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download
memory/1104-56-0x00000000004F0000-0x0000000000502000-memory.dmp

Filesize
72KB

Download
memory/1104-57-0x00000000046B0000-0x0000000004736000-memory.dmp

Filesize
536KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads