xloader | b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4

Analysis

max time kernel
114s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
Size

475KB
MD5

b3a02a5fe7271490ffb71864b290eb31
SHA1

42cca26695441ca89557dcc7ea09c4435b43c0b4
SHA256

b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4
SHA512

70f47a995acd0cefc8ca4f116b2f6b03a00c897e7e50c59b5f842f23b003619926b135d9a44197f0a4f312fd7bf0ef0cb89596926385a8b76525561eb88d2bfa
SSDEEP

12288:/cz6hGcejvydcHYo+6pFxyYAARXWA8uWGXhlqFCA8KI:ECjo+6/xyYAARgwhY8n

Score

10^/10

xloader ur06 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ur06

Decoy

philippebrooksdesign.com

cmoorestudio.com

profille-sarina23tammara.club

dqulxe.com

uiffinger.com

nolarapper.com

maconanimalexterminator.com

bisovka.com

loveisloveent.com

datication.com

spxo66.com

drhelpnow.com

ladybug-cle.com

macocome.com

thepoppysocks.com

eldritchparadox.com

mercadolibre.company

ismartfarm.com

kansascarlot.com

kevinld.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1524-61-0x000000000041D000-mapping.dmp	xloader
behavioral1/memory/1524-60-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe

description	pid	process	target process
PID 1392 set thread context of 1524	1392	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe

pid process

1524 b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe

pid	process
1524	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe

description	pid	process	target process
PID 1392 wrote to memory of 1524	1392	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
PID 1392 wrote to memory of 1524	1392	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
PID 1392 wrote to memory of 1524	1392	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
PID 1392 wrote to memory of 1524	1392	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
PID 1392 wrote to memory of 1524	1392	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
PID 1392 wrote to memory of 1524	1392	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
PID 1392 wrote to memory of 1524	1392	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe

C:\Users\Admin\AppData\Local\Temp\b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
"C:\Users\Admin\AppData\Local\Temp\b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1392

C:\Users\Admin\AppData\Local\Temp\b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
"C:\Users\Admin\AppData\Local\Temp\b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1524

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1392-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/1392-55-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/1392-56-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/1392-62-0x00000000745A0000-0x0000000074B4B000-memory.dmp

Filesize
5.7MB

Download
memory/1524-57-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1524-58-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1524-61-0x000000000041D000-mapping.dmp

Download
memory/1524-60-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1524-63-0x0000000000AB0000-0x0000000000DB3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads