xloader | 1cf1f7f61bb2fcdf5746b58681b0050e68076268cd08c1419ec869117ec7fcbb

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a76c158c4755f2c88c08a983ff96473.exe
Size

692KB
MD5

8a76c158c4755f2c88c08a983ff96473
SHA1

35f2fa98f04dafb50967c03d1f6b87c1ee1134e4
SHA256

1cf1f7f61bb2fcdf5746b58681b0050e68076268cd08c1419ec869117ec7fcbb
SHA512

273eeda207b4e3fdf093e74bb0088c931b813731294dcfc9a16eceb8a8a894cd3bc3ce9a4a4aac04ce3af4da0e747397f3091deb6d81cb8c8e42bb7334e42090
SSDEEP

12288:/3bPU9vPU96Dm+s/IoOOsBgo0q4wMpLIUx0WytghL34yzHdtmwbp8P5i0:/3uoOOsBgo0q4wM6Wyt+oyzHdtmwbpUb

Score

10^/10

xloader ipa8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ipa8

Decoy

royalposhpups.com

univa.world

lanerbo.com

shopbabygo.com

theutahhomestore.com

serialmixer.icu

linfeiya.com

xn--12cg3de5c2eb5cyi.com

am-conseil-communication.com

dailygame168.com

therightmilitia.com

visions-agency.com

mapopi.com

frugallyketo.com

guapandglo.com

54w-x126v.net

your-health-kick.com

blockchainhub360.com

registernowhd.xyz

votekellykitashima.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/1724-3-0x0000000000520000-0x0000000000532000-memory.dmp	CustAttr

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2656-14-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

8a76c158c4755f2c88c08a983ff96473.exe

description pid process target process

PID 1724 set thread context of 2656 1724 8a76c158c4755f2c88c08a983ff96473.exe 8a76c158c4755f2c88c08a983ff96473.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

8a76c158c4755f2c88c08a983ff96473.exe

pid process

2656 8a76c158c4755f2c88c08a983ff96473.exe

description	pid	process	target process
PID 1724 set thread context of 2656	1724	8a76c158c4755f2c88c08a983ff96473.exe	8a76c158c4755f2c88c08a983ff96473.exe

pid	process
2656	8a76c158c4755f2c88c08a983ff96473.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

8a76c158c4755f2c88c08a983ff96473.exe

description	pid	process	target process
PID 1724 wrote to memory of 2656	1724	8a76c158c4755f2c88c08a983ff96473.exe	8a76c158c4755f2c88c08a983ff96473.exe
PID 1724 wrote to memory of 2656	1724	8a76c158c4755f2c88c08a983ff96473.exe	8a76c158c4755f2c88c08a983ff96473.exe
PID 1724 wrote to memory of 2656	1724	8a76c158c4755f2c88c08a983ff96473.exe	8a76c158c4755f2c88c08a983ff96473.exe
PID 1724 wrote to memory of 2656	1724	8a76c158c4755f2c88c08a983ff96473.exe	8a76c158c4755f2c88c08a983ff96473.exe
PID 1724 wrote to memory of 2656	1724	8a76c158c4755f2c88c08a983ff96473.exe	8a76c158c4755f2c88c08a983ff96473.exe
PID 1724 wrote to memory of 2656	1724	8a76c158c4755f2c88c08a983ff96473.exe	8a76c158c4755f2c88c08a983ff96473.exe
PID 1724 wrote to memory of 2656	1724	8a76c158c4755f2c88c08a983ff96473.exe	8a76c158c4755f2c88c08a983ff96473.exe

C:\Users\Admin\AppData\Local\Temp\8a76c158c4755f2c88c08a983ff96473.exe
"C:\Users\Admin\AppData\Local\Temp\8a76c158c4755f2c88c08a983ff96473.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Admin\AppData\Local\Temp\8a76c158c4755f2c88c08a983ff96473.exe
"C:\Users\Admin\AppData\Local\Temp\8a76c158c4755f2c88c08a983ff96473.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2656

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-6-0x0000000007CA0000-0x0000000007D1C000-memory.dmp

Filesize
496KB

Download
memory/1724-0-0x0000000000A90000-0x0000000000B44000-memory.dmp

Filesize
720KB

Download
memory/1724-2-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download
memory/1724-3-0x0000000000520000-0x0000000000532000-memory.dmp

Filesize
72KB

Download
memory/1724-4-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/1724-5-0x0000000004E00000-0x0000000004E40000-memory.dmp

Filesize
256KB

Download
memory/1724-1-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/1724-7-0x0000000000A30000-0x0000000000A64000-memory.dmp

Filesize
208KB

Download
memory/1724-15-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2656-16-0x0000000000B50000-0x0000000000E53000-memory.dmp

Filesize
3.0MB

Download
memory/2656-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2656-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2656-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2656-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads