xloader | 7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
Size

621KB
MD5

79a27708f1ff4dfa461500891bff39e2
SHA1

a517e7a24241a83aebb3f3be2b477cbf1dbe59d3
SHA256

7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a
SHA512

404f6c774fdc15c5aea3e053723be2c2b9cc9e6d3ec0a004c1f3331bbfe9fd8f22008f51535ed9cb705e7797491e682622fba57e43c8d6055c26896867f30e8e
SSDEEP

12288:JxTE6jCfk3q75Iqjf7rYmfwzxIf3RAKsXQHHc5n6rovf8WlPlD:JxvCZdIKfbIzxIf3RAK0QKF0WldD

Score

10^/10

xloader uszn loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

uszn

Decoy

animegriptape.com

pcpnetworks.com

putupmybabyforadoption.com

xn--jvrr98g37n88d.com

fertinvitro.doctor

undonethread.com

avoleague.com

sissysundays.com

guilhermeoliveiro.site

catholicon-bespeckle.info

mardesuenosfundacion.com

songkhoe24.site

shoecityindia.com

smallbathroomdecor.info

tskusa.com

prairiespringsllc.com

kegncoffee.com

clicklounge.xyz

catholicendoflifeplanning.com

steelobzee.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2472-138-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

description	pid	process	target process
PID 1440 set thread context of 2472	1440	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

pid	process
1440	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
2472	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
2472	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

description pid process

Token: SeDebugPrivilege 1440 7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

description	pid	process
Token: SeDebugPrivilege	1440	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

description	pid	process	target process
PID 1440 wrote to memory of 2472	1440	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
PID 1440 wrote to memory of 2472	1440	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
PID 1440 wrote to memory of 2472	1440	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
PID 1440 wrote to memory of 2472	1440	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
PID 1440 wrote to memory of 2472	1440	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
PID 1440 wrote to memory of 2472	1440	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe	7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe

C:\Users\Admin\AppData\Local\Temp\7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
"C:\Users\Admin\AppData\Local\Temp\7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440

C:\Users\Admin\AppData\Local\Temp\7cf0d5b485b4e7d4105299764d2e6b5db558537b577c645a24bc84b093d55d8a.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1440-132-0x00000000007B0000-0x0000000000850000-memory.dmp

Filesize
640KB

Download
memory/1440-133-0x0000000005900000-0x0000000005EA4000-memory.dmp

Filesize
5.6MB

Download
memory/1440-134-0x0000000005200000-0x0000000005292000-memory.dmp

Filesize
584KB

Download
memory/1440-135-0x00000000051F0000-0x00000000051FA000-memory.dmp

Filesize
40KB

Download
memory/1440-136-0x0000000008940000-0x00000000089DC000-memory.dmp

Filesize
624KB

Download
memory/2472-137-0x0000000000000000-mapping.dmp

Download
memory/2472-138-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2472-139-0x0000000000EF0000-0x000000000123A000-memory.dmp

Filesize
3.3MB

Download