xloader | c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6

Analysis

max time kernel
133s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
Size

427KB
MD5

881cb9ada2d3716cd4330896b3e4987c
SHA1

b678a01eef1a01228e2f7a6ca6896d23a7c7e21e
SHA256

c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6
SHA512

99d32f86d2b242dc8045bba1161e070d1312d04b4d631b703b3bd0d7a2d1a4854cd464456a3746952420d75a146720cec97827ec8471ac2ad3b6fbb9e047ece4
SSDEEP

12288:73WVhLHvDXG4KFi1bdhWJ562uF14cedCLUdLLLj:7GVxrX0gpdUXu8vQeX

Score

10^/10

xloader ur06 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ur06

Decoy

philippebrooksdesign.com

cmoorestudio.com

profille-sarina23tammara.club

dqulxe.com

uiffinger.com

nolarapper.com

maconanimalexterminator.com

bisovka.com

loveisloveent.com

datication.com

spxo66.com

drhelpnow.com

ladybug-cle.com

macocome.com

thepoppysocks.com

eldritchparadox.com

mercadolibre.company

ismartfarm.com

kansascarlot.com

kevinld.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/720-135-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe

description	pid	process	target process
PID 3040 set thread context of 720	3040	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe

pid	process
720	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
720	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe

description	pid	process	target process
PID 3040 wrote to memory of 720	3040	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
PID 3040 wrote to memory of 720	3040	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
PID 3040 wrote to memory of 720	3040	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
PID 3040 wrote to memory of 720	3040	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
PID 3040 wrote to memory of 720	3040	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
PID 3040 wrote to memory of 720	3040	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe	c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe

C:\Users\Admin\AppData\Local\Temp\c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
"C:\Users\Admin\AppData\Local\Temp\c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3040

C:\Users\Admin\AppData\Local\Temp\c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe
"C:\Users\Admin\AppData\Local\Temp\c78e3c0aaddffb294d0897b695d2983fef45b201a40be68b8932acb32d5f32d6.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/720-134-0x0000000000000000-mapping.dmp

Download
memory/720-135-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/720-137-0x00000000012E0000-0x000000000162A000-memory.dmp

Filesize
3.3MB

Download
memory/3040-132-0x0000000074B40000-0x00000000750F1000-memory.dmp

Filesize
5.7MB

Download
memory/3040-133-0x0000000074B40000-0x00000000750F1000-memory.dmp

Filesize
5.7MB

Download
memory/3040-136-0x0000000074B40000-0x00000000750F1000-memory.dmp

Filesize
5.7MB

Download