xloader | 5b127ba9e944e4b488f41fe31a345d14ea87b4f812074208480d79739c3795ea

Analysis

max time kernel
155s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

316117c4290a6293368dc1d49ef5cf11.exe
Size

252KB
MD5

316117c4290a6293368dc1d49ef5cf11
SHA1

14e6d42121e534f61244e5096380cf36138a88e4
SHA256

5b127ba9e944e4b488f41fe31a345d14ea87b4f812074208480d79739c3795ea
SHA512

5f4e2efa25b164cc4b3820dde68a55f77915357544ba5f751d44cc654c287bfcc0e325a020a46a683d7e3d9e688efc27be3fcb1e83b01941f3ac623a5de65e7e
SSDEEP

6144:Cd53TvpHeIl0/fnSQzarEoYmvVBAamv9lulRi6cvM3MSflfH:Cd53TvpHeIl0/fnjzaDYmvnAakucvGfZ

Score

10^/10

xloader p596 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

p596

Decoy

ushistorical.com

lovepropertylondon.com

acupress-the-point.com

3772548.com

ambientabuse.com

primaveracm.com

themidwestmomblog.com

havasavunma.com

rockyroadbrand.com

zzphys.com

masque-inclusif.com

myeonyeokplus.com

linkernet.pro

zezirma.com

mysiniar.com

andreamall.com

mattesonauto.com

wandopowerinc.com

casaurgence.com

salishseaquilts.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2040-3-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

316117c4290a6293368dc1d49ef5cf11.exe

description pid process target process

PID 2088 set thread context of 2040 2088 316117c4290a6293368dc1d49ef5cf11.exe 316117c4290a6293368dc1d49ef5cf11.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

316117c4290a6293368dc1d49ef5cf11.exe

pid process

2040 316117c4290a6293368dc1d49ef5cf11.exe
2040 316117c4290a6293368dc1d49ef5cf11.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

316117c4290a6293368dc1d49ef5cf11.exe

pid process

2088 316117c4290a6293368dc1d49ef5cf11.exe

description	pid	process	target process
PID 2088 set thread context of 2040	2088	316117c4290a6293368dc1d49ef5cf11.exe	316117c4290a6293368dc1d49ef5cf11.exe

pid	process
2040	316117c4290a6293368dc1d49ef5cf11.exe
2040	316117c4290a6293368dc1d49ef5cf11.exe

pid	process
2088	316117c4290a6293368dc1d49ef5cf11.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

316117c4290a6293368dc1d49ef5cf11.exe

description	pid	process	target process
PID 2088 wrote to memory of 2040	2088	316117c4290a6293368dc1d49ef5cf11.exe	316117c4290a6293368dc1d49ef5cf11.exe
PID 2088 wrote to memory of 2040	2088	316117c4290a6293368dc1d49ef5cf11.exe	316117c4290a6293368dc1d49ef5cf11.exe
PID 2088 wrote to memory of 2040	2088	316117c4290a6293368dc1d49ef5cf11.exe	316117c4290a6293368dc1d49ef5cf11.exe
PID 2088 wrote to memory of 2040	2088	316117c4290a6293368dc1d49ef5cf11.exe	316117c4290a6293368dc1d49ef5cf11.exe

C:\Users\Admin\AppData\Local\Temp\316117c4290a6293368dc1d49ef5cf11.exe
"C:\Users\Admin\AppData\Local\Temp\316117c4290a6293368dc1d49ef5cf11.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2088

C:\Users\Admin\AppData\Local\Temp\316117c4290a6293368dc1d49ef5cf11.exe
"C:\Users\Admin\AppData\Local\Temp\316117c4290a6293368dc1d49ef5cf11.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2040-4-0x0000000000A30000-0x0000000000D7A000-memory.dmp

Filesize
3.3MB

Download
memory/2088-2-0x0000000000590000-0x0000000000592000-memory.dmp

Filesize
8KB

Download
memory/2088-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download