xloader | a6fc3c2cd878129322903c09b84a057046b772e92e883b002714574fff834bde

Analysis

max time kernel
147s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fe9a3470f0ac5c1d00d26e08a22579f.exe
Size

671KB
MD5

6fe9a3470f0ac5c1d00d26e08a22579f
SHA1

a88181b197bda78c80718197e9e4337baa6b96d5
SHA256

a6fc3c2cd878129322903c09b84a057046b772e92e883b002714574fff834bde
SHA512

ecb0a597f5a60b8593ac82bbc6092cf65e3de71f2e4f9e48d2c446159d812f74a44a7ad6054b058901a165dae5b202296bedbc30e110af3d1e7403cbda563805
SSDEEP

12288:YGcQNKL5XwINR3shZLJQ05nFwrvqHfp9y:/CRwUO/ddOTIfDy

Score

10^/10

xloader uytf loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

uytf

Decoy

elife-home-internet.com

amberbandyoutube.com

myhomemechanism.net

nuosports.com

universalpartnersintl.com

greatmix106.com

fangxianger.com

dreampic.net

lifteddevelopments.com

astyledsurface.com

meditationkota.com

hungry4theholy1.com

8belowrescue.com

almostmidnightgames.com

lifelonghiker.com

maridaniellecontreras.com

hisport.info

loveforquality.com

baincot3.com

theneuro-link.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4608-12-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1832 set thread context of 4608	1832	6fe9a3470f0ac5c1d00d26e08a22579f.exe	97

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4608	6fe9a3470f0ac5c1d00d26e08a22579f.exe
4608	6fe9a3470f0ac5c1d00d26e08a22579f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 4608	1832	6fe9a3470f0ac5c1d00d26e08a22579f.exe	97
PID 1832 wrote to memory of 4608	1832	6fe9a3470f0ac5c1d00d26e08a22579f.exe	97
PID 1832 wrote to memory of 4608	1832	6fe9a3470f0ac5c1d00d26e08a22579f.exe	97
PID 1832 wrote to memory of 4608	1832	6fe9a3470f0ac5c1d00d26e08a22579f.exe	97
PID 1832 wrote to memory of 4608	1832	6fe9a3470f0ac5c1d00d26e08a22579f.exe	97
PID 1832 wrote to memory of 4608	1832	6fe9a3470f0ac5c1d00d26e08a22579f.exe	97

C:\Users\Admin\AppData\Local\Temp\6fe9a3470f0ac5c1d00d26e08a22579f.exe
"C:\Users\Admin\AppData\Local\Temp\6fe9a3470f0ac5c1d00d26e08a22579f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\6fe9a3470f0ac5c1d00d26e08a22579f.exe
  "C:\Users\Admin\AppData\Local\Temp\6fe9a3470f0ac5c1d00d26e08a22579f.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-6-0x0000000006560000-0x00000000065FC000-memory.dmp

Filesize
624KB

Download
memory/1832-10-0x0000000006B70000-0x0000000006BD6000-memory.dmp

Filesize
408KB

Download
memory/1832-2-0x00000000056A0000-0x0000000005C44000-memory.dmp

Filesize
5.6MB

Download
memory/1832-3-0x00000000050F0000-0x0000000005182000-memory.dmp

Filesize
584KB

Download
memory/1832-4-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/1832-5-0x0000000005190000-0x000000000519A000-memory.dmp

Filesize
40KB

Download
memory/1832-1-0x0000000000790000-0x000000000083E000-memory.dmp

Filesize
696KB

Download
memory/1832-8-0x00000000749C0000-0x0000000075170000-memory.dmp

Filesize
7.7MB

Download
memory/1832-0-0x00000000749C0000-0x0000000075170000-memory.dmp

Filesize
7.7MB

Download
memory/1832-9-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/1832-7-0x00000000064D0000-0x00000000064EC000-memory.dmp

Filesize
112KB

Download
memory/1832-11-0x0000000009190000-0x00000000091BE000-memory.dmp

Filesize
184KB

Download
memory/1832-14-0x00000000749C0000-0x0000000075170000-memory.dmp

Filesize
7.7MB

Download
memory/4608-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4608-15-0x00000000012D0000-0x000000000161A000-memory.dmp

Filesize
3.3MB

Download