xloader | 79e535de63f31e04e3565e35d8fcad297ff2dd8bda659a15c13ccee4a11a6e30

Analysis

max time kernel
97s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 15:00

Target
02ae7f4c28fa27bb522b25762a2eacab.exe
Size 271KB
Sample231224-sds6nsdce3
SHA256 79e535de63f31e04e3565e35d8fcad297ff2dd8bda659a15c13ccee4a11a6e30
MD5 02ae7f4c28fa27bb522b25762a2eacab
SHA1 5b49eb9e66a71e42591e4761d17084869ca7f4b2
SHA512 78e3ba30d608a1d5a6db1cd5677e62e85b940e8a6422d5bc1ca80f77825534cc97a8b7a80a26a50d72c4e62c213cda4af7673373119993a901929cb9ca35f2e7
SSDEEP 6144:OK++hEjavND5MppH7SZebWtvzwYU8bu5pn8kUUXtwjlp1am09h:lMLH7fbAvzwp8bmpn8kUUdmza/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

Campaign

Decoy

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4672-3-0x0000000000630000-0x0000000000659000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3980 set thread context of 4672	3980	02ae7f4c28fa27bb522b25762a2eacab.exe	88

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4672	02ae7f4c28fa27bb522b25762a2eacab.exe
4672	02ae7f4c28fa27bb522b25762a2eacab.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3980	02ae7f4c28fa27bb522b25762a2eacab.exe
3980	02ae7f4c28fa27bb522b25762a2eacab.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4672	3980	02ae7f4c28fa27bb522b25762a2eacab.exe	88
PID 3980 wrote to memory of 4672	3980	02ae7f4c28fa27bb522b25762a2eacab.exe	88
PID 3980 wrote to memory of 4672	3980	02ae7f4c28fa27bb522b25762a2eacab.exe	88
PID 3980 wrote to memory of 4672	3980	02ae7f4c28fa27bb522b25762a2eacab.exe	88

C:\Users\Admin\AppData\Local\Temp\02ae7f4c28fa27bb522b25762a2eacab.exe
"C:\Users\Admin\AppData\Local\Temp\02ae7f4c28fa27bb522b25762a2eacab.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Users\Admin\AppData\Local\Temp\02ae7f4c28fa27bb522b25762a2eacab.exe
  "C:\Users\Admin\AppData\Local\Temp\02ae7f4c28fa27bb522b25762a2eacab.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672

memory/3980-1-0x0000000000CD0000-0x0000000000DD0000-memory.dmp

Download

memory/3980-2-0x0000000001650000-0x0000000001652000-memory.dmp

Download

memory/4672-3-0x0000000000630000-0x0000000000659000-memory.dmp

Download

memory/4672-6-0x0000000000D80000-0x00000000010CA000-memory.dmp

Download

memory/4672-7-0x0000000000D80000-0x00000000010CA000-memory.dmp

Download