xloader | b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4

Analysis

max time kernel
142s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
Size

475KB
MD5

b3a02a5fe7271490ffb71864b290eb31
SHA1

42cca26695441ca89557dcc7ea09c4435b43c0b4
SHA256

b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4
SHA512

70f47a995acd0cefc8ca4f116b2f6b03a00c897e7e50c59b5f842f23b003619926b135d9a44197f0a4f312fd7bf0ef0cb89596926385a8b76525561eb88d2bfa
SSDEEP

12288:/cz6hGcejvydcHYo+6pFxyYAARXWA8uWGXhlqFCA8KI:ECjo+6/xyYAARgwhY8n

Score

10^/10

xloader ur06 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ur06

Decoy

philippebrooksdesign.com

cmoorestudio.com

profille-sarina23tammara.club

dqulxe.com

uiffinger.com

nolarapper.com

maconanimalexterminator.com

bisovka.com

loveisloveent.com

datication.com

spxo66.com

drhelpnow.com

ladybug-cle.com

macocome.com

thepoppysocks.com

eldritchparadox.com

mercadolibre.company

ismartfarm.com

kansascarlot.com

kevinld.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2124-136-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe

description	pid	process	target process
PID 1900 set thread context of 2124	1900	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exeb41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe

pid	process
1900	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
1900	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
2124	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
2124	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe

description pid process

Token: SeDebugPrivilege 1900 b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe

description	pid	process
Token: SeDebugPrivilege	1900	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe

description	pid	process	target process
PID 1900 wrote to memory of 4184	1900	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
PID 1900 wrote to memory of 4184	1900	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
PID 1900 wrote to memory of 4184	1900	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
PID 1900 wrote to memory of 2124	1900	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
PID 1900 wrote to memory of 2124	1900	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
PID 1900 wrote to memory of 2124	1900	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
PID 1900 wrote to memory of 2124	1900	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
PID 1900 wrote to memory of 2124	1900	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
PID 1900 wrote to memory of 2124	1900	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe	b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe

C:\Users\Admin\AppData\Local\Temp\b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
"C:\Users\Admin\AppData\Local\Temp\b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900

C:\Users\Admin\AppData\Local\Temp\b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
"C:\Users\Admin\AppData\Local\Temp\b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe"
2⤵
PID:4184

C:\Users\Admin\AppData\Local\Temp\b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe
"C:\Users\Admin\AppData\Local\Temp\b41fc4ddbe7bacd80a58ebfe9f65177cd5be98604b1f029bb58ee7469bb9f5d4.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1900-132-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/1900-133-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/1900-137-0x00000000753F0000-0x00000000759A1000-memory.dmp

Filesize
5.7MB

Download
memory/2124-135-0x0000000000000000-mapping.dmp

Download
memory/2124-136-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2124-138-0x0000000001090000-0x00000000013DA000-memory.dmp

Filesize
3.3MB

Download
memory/4184-134-0x0000000000000000-mapping.dmp

Download