xloader | b4bb472d39c592fc4e99ecdd59cc1284255666c72ba5eccc7f5b39780e53141e

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f97387cf1ed097f9f1185ecb8d63d425.exe
Size

418KB
MD5

f97387cf1ed097f9f1185ecb8d63d425
SHA1

a737798f98adfedab12d1b8161ebfc0db31767da
SHA256

b4bb472d39c592fc4e99ecdd59cc1284255666c72ba5eccc7f5b39780e53141e
SHA512

b8aadb681f1e492bea50f722d34a431c5fb46c32fdb23ca54f5bc43474672dae49ef95d3e3188b739561b6f76c8d05b1ab07d34473da2c3a1dcfff18a866185d
SSDEEP

6144:3LTfaVy5OOu+n20JpbO8yfyV68lyixJQ0KDJNXiTF85rDcp0+DMC:vfalOu+n/U8c50WNCFy3x+QC

Score

10^/10

xloader b6a4 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

b6a4

Decoy

reviewsresolutions.com

binhminhgardenshophouse.com

nebulacom.com

kadhambaristudio.com

viltoom.club

supmomma.com

tjszxddc.com

darlingmemories.com

hyperultrapure.com

vibembrio.com

reallycoolmask.com

cumbukita.com

brian-newby.com

abstractaccessories.com

marykinky.com

minnesotareversemtgloans.com

prasetlement.com

xplpgi.com

xn--gdask-y7a.com

uababaseball.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1304-3-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/1304-5-0x0000000000810000-0x0000000000B13000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

f97387cf1ed097f9f1185ecb8d63d425.exe

description pid process target process

PID 1796 set thread context of 1304 1796 f97387cf1ed097f9f1185ecb8d63d425.exe f97387cf1ed097f9f1185ecb8d63d425.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f97387cf1ed097f9f1185ecb8d63d425.exe

pid process

1304 f97387cf1ed097f9f1185ecb8d63d425.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

f97387cf1ed097f9f1185ecb8d63d425.exe

pid process

1796 f97387cf1ed097f9f1185ecb8d63d425.exe

description	pid	process	target process
PID 1796 set thread context of 1304	1796	f97387cf1ed097f9f1185ecb8d63d425.exe	f97387cf1ed097f9f1185ecb8d63d425.exe

pid	process
1304	f97387cf1ed097f9f1185ecb8d63d425.exe

pid	process
1796	f97387cf1ed097f9f1185ecb8d63d425.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f97387cf1ed097f9f1185ecb8d63d425.exe

description	pid	process	target process
PID 1796 wrote to memory of 1304	1796	f97387cf1ed097f9f1185ecb8d63d425.exe	f97387cf1ed097f9f1185ecb8d63d425.exe
PID 1796 wrote to memory of 1304	1796	f97387cf1ed097f9f1185ecb8d63d425.exe	f97387cf1ed097f9f1185ecb8d63d425.exe
PID 1796 wrote to memory of 1304	1796	f97387cf1ed097f9f1185ecb8d63d425.exe	f97387cf1ed097f9f1185ecb8d63d425.exe
PID 1796 wrote to memory of 1304	1796	f97387cf1ed097f9f1185ecb8d63d425.exe	f97387cf1ed097f9f1185ecb8d63d425.exe
PID 1796 wrote to memory of 1304	1796	f97387cf1ed097f9f1185ecb8d63d425.exe	f97387cf1ed097f9f1185ecb8d63d425.exe

C:\Users\Admin\AppData\Local\Temp\f97387cf1ed097f9f1185ecb8d63d425.exe
"C:\Users\Admin\AppData\Local\Temp\f97387cf1ed097f9f1185ecb8d63d425.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1796

C:\Users\Admin\AppData\Local\Temp\f97387cf1ed097f9f1185ecb8d63d425.exe
"C:\Users\Admin\AppData\Local\Temp\f97387cf1ed097f9f1185ecb8d63d425.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1304

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1304-4-0x0000000000810000-0x0000000000B13000-memory.dmp

Filesize
3.0MB

Download
memory/1304-5-0x0000000000810000-0x0000000000B13000-memory.dmp

Filesize
3.0MB

Download
memory/1796-1-0x0000000000310000-0x0000000000410000-memory.dmp

Filesize
1024KB

Download
memory/1796-2-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download