xloader | 3f9a8485314c2b666caf0a1a729a96cb974780f331ea9baa0c03e7f02035cf05

Analysis

max time kernel
159s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 23:29

Target
06f47d6c56ea1cf96bd70d113ee661f1.exe
Size 527KB
Sample231229-3gy67sfcfr
SHA256 3f9a8485314c2b666caf0a1a729a96cb974780f331ea9baa0c03e7f02035cf05
MD5 06f47d6c56ea1cf96bd70d113ee661f1
SHA1 30f26d59be9ec21bd7c3df0eda359482864702b7
SHA512 8cfdfae74dd186314a804fbe63af5a34714ee20a462dcfabf6c164e51e821c44915edec56a4a0433083a8e025e90c5a6e22064c4811d460d2a9aac54f4ac389e
SSDEEP 12288:SBn0RN617gNm5YnXDdRgMVahjLySXJGejXhB75Kc3YEuIHdC:SBn0RNlDdRg6axmSgoRBUzIHdC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

Campaign

Decoy

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1960-2-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4352 set thread context of 1960	4352	06f47d6c56ea1cf96bd70d113ee661f1.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1960	06f47d6c56ea1cf96bd70d113ee661f1.exe
1960	06f47d6c56ea1cf96bd70d113ee661f1.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4352	06f47d6c56ea1cf96bd70d113ee661f1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 1960	4352	06f47d6c56ea1cf96bd70d113ee661f1.exe	89
PID 4352 wrote to memory of 1960	4352	06f47d6c56ea1cf96bd70d113ee661f1.exe	89
PID 4352 wrote to memory of 1960	4352	06f47d6c56ea1cf96bd70d113ee661f1.exe	89
PID 4352 wrote to memory of 1960	4352	06f47d6c56ea1cf96bd70d113ee661f1.exe	89

C:\Users\Admin\AppData\Local\Temp\06f47d6c56ea1cf96bd70d113ee661f1.exe
"C:\Users\Admin\AppData\Local\Temp\06f47d6c56ea1cf96bd70d113ee661f1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Users\Admin\AppData\Local\Temp\06f47d6c56ea1cf96bd70d113ee661f1.exe
  "C:\Users\Admin\AppData\Local\Temp\06f47d6c56ea1cf96bd70d113ee661f1.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1960

memory/1960-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1960-4-0x0000000001380000-0x00000000016CA000-memory.dmp

Download

memory/4352-3-0x00000000007F0000-0x0000000000844000-memory.dmp

Download

memory/4352-1-0x0000000002EE0000-0x0000000002EE2000-memory.dmp

Download

memory/4352-0-0x00000000007F0000-0x0000000000844000-memory.dmp

Download