xloader | c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6

Analysis

max time kernel
118s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
Size

427KB
MD5

881cb9ada2d3716cd4330896b3e4987c
SHA1

b678a01eef1a01228e2f7a6ca6896d23a7c7e21e
SHA256

c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6
SHA512

99d32f86d2b242dc8045bba1161e070d1312d04b4d631b703b3bd0d7a2d1a4854cd464456a3746952420d75a146720cec97827ec8471ac2ad3b6fbb9e047ece4
SSDEEP

12288:73WVhLHvDXG4KFi1bdhWJ562uF14cedCLUdLLLj:7GVxrX0gpdUXu8vQeX

Score

10^/10

xloader ur06 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ur06

Decoy

philippebrooksdesign.com

cmoorestudio.com

profille-sarina23tammara.club

dqulxe.com

uiffinger.com

nolarapper.com

maconanimalexterminator.com

bisovka.com

loveisloveent.com

datication.com

spxo66.com

drhelpnow.com

ladybug-cle.com

macocome.com

thepoppysocks.com

eldritchparadox.com

mercadolibre.company

ismartfarm.com

kansascarlot.com

kevinld.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1272-60-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/1272-61-0x000000000041D000-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe

description	pid	process	target process
PID 856 set thread context of 1272	856	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe

pid process

1272 c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe

pid	process
1272	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe

description	pid	process	target process
PID 856 wrote to memory of 1272	856	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
PID 856 wrote to memory of 1272	856	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
PID 856 wrote to memory of 1272	856	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
PID 856 wrote to memory of 1272	856	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
PID 856 wrote to memory of 1272	856	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
PID 856 wrote to memory of 1272	856	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
PID 856 wrote to memory of 1272	856	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe

C:\Users\Admin\AppData\Local\Temp\c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
"C:\Users\Admin\AppData\Local\Temp\c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:856

C:\Users\Admin\AppData\Local\Temp\c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
"C:\Users\Admin\AppData\Local\Temp\c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1272

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/856-55-0x0000000074770000-0x0000000074D1B000-memory.dmp

Filesize
5.7MB

Download
memory/856-56-0x0000000074770000-0x0000000074D1B000-memory.dmp

Filesize
5.7MB

Download
memory/856-62-0x0000000074770000-0x0000000074D1B000-memory.dmp

Filesize
5.7MB

Download
memory/1272-57-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1272-58-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1272-60-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1272-61-0x000000000041D000-mapping.dmp

Download
memory/1272-63-0x0000000000A20000-0x0000000000D23000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads