xloader | ad448bb6ae092edc75f674601f4cffefcb02a017390ec76359e7e8191bedef70

Analysis

max time kernel
39s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25-05-2023 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
Size

356KB
MD5

cb94f8bf4453d77ed35b4cccad18260c
SHA1

aeacb009addb2152c05a34537f565e66b32b25d2
SHA256

a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466
SHA512

7fb17a554481d5ff6c28edd4ee43b9306a8e59ac9f992a2b6d243b2d88eb9daa997bbf5be962f331c6ec282b15e4e67107c233691a6b05d317957072754f4135
SSDEEP

6144:lZwkVnw0KesTf8DZgu2OuQ15Mgkv0StJXgBivzsXjpY/i0un1IC1ewYrbOhpRRRY:lZ7Laf8DqOrRk8+JXUMzeYRun19ewskC

Score

10^/10

xloader c6si loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

c6si

Decoy

tristateinc.construction

americanscaregroundstexas.com

kanimisoshiru.com

wihling.com

fishcheekstosa.com

parentsfuid.com

greenstandmarket.com

fc8fla8kzq.com

gametwist-83.club

jobsncvs.com

directrealtysells.com

avida2015.com

conceptasite.net

arkaneattire.com

indev-mobility.info

2160centurypark412.com

valefloor.com

septembership.com

stackflix.com

jimc0sales.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/972-62-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe

description	pid	process	target process
PID 904 set thread context of 972	904	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe

pid process

972 a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe

pid	process
972	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe

description	pid	process	target process
PID 904 wrote to memory of 972	904	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
PID 904 wrote to memory of 972	904	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
PID 904 wrote to memory of 972	904	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
PID 904 wrote to memory of 972	904	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
PID 904 wrote to memory of 972	904	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
PID 904 wrote to memory of 972	904	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
PID 904 wrote to memory of 972	904	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
PID 904 wrote to memory of 972	904	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
PID 904 wrote to memory of 972	904	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
PID 904 wrote to memory of 972	904	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe

C:\Users\Admin\AppData\Local\Temp\a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
"C:\Users\Admin\AppData\Local\Temp\a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:904

C:\Users\Admin\AppData\Local\Temp\a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
"C:\Users\Admin\AppData\Local\Temp\a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:972

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-54-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Filesize
384KB

Download
memory/904-55-0x0000000004D60000-0x0000000004DA0000-memory.dmp

Filesize
256KB

Download
memory/904-56-0x00000000008D0000-0x00000000008E0000-memory.dmp

Filesize
64KB

Download
memory/904-57-0x0000000004D60000-0x0000000004DA0000-memory.dmp

Filesize
256KB

Download
memory/904-58-0x0000000005E70000-0x0000000005ECE000-memory.dmp

Filesize
376KB

Download
memory/972-59-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/972-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/972-61-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/972-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/972-63-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads