xloader | 52b0438a43977e210e58786f139697a9007854f624d8901c891a9af69b87667f

Analysis

max time kernel
148s
max time network
158s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02b89444a1d633c44e1e9e54e3fdd1b0.exe
Size

945KB
MD5

02b89444a1d633c44e1e9e54e3fdd1b0
SHA1

6d560a1c41457fa9c88d5d218ea4a9ae670fbedd
SHA256

52b0438a43977e210e58786f139697a9007854f624d8901c891a9af69b87667f
SHA512

1521d912a90f74e46a6428eb4ee6bdf7561ff05260b9243a34e724b9be1424bec2f7c78ea527097a3d75f349e5afa485bc9aeb159d6186e1f621e462eacda5f7
SSDEEP

12288:qxDc9F3nC0Py3gAhSEJbjJEK1+E5Gl6twEtG5FhVvjRrry8rXcuzDD8qfv:6J5Gl6HE5FhhjRvy8Zdv

Score

10^/10

xloader earz loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

earz

Decoy

halacoupon.com

anthos-labs.com

hagertylabs.net

l1992.com

856379580.xyz

rcbb-technologies.com

realhoggapparel.com

sauceprince.com

tootingcab.com

4chase5.com

ordergogibibimbap.com

nyj.xyz

dermixspa.com

premiergiftingco.com

razorcentric.com

mbrealtyadvisors.com

officialjazz.club

cctv006.com

hbcuatthepolls.info

prestamos-ya.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/780-13-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2628 set thread context of 780	2628	02b89444a1d633c44e1e9e54e3fdd1b0.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1216	780	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 780	2628	02b89444a1d633c44e1e9e54e3fdd1b0.exe	29
PID 2628 wrote to memory of 780	2628	02b89444a1d633c44e1e9e54e3fdd1b0.exe	29
PID 2628 wrote to memory of 780	2628	02b89444a1d633c44e1e9e54e3fdd1b0.exe	29
PID 2628 wrote to memory of 780	2628	02b89444a1d633c44e1e9e54e3fdd1b0.exe	29
PID 2628 wrote to memory of 780	2628	02b89444a1d633c44e1e9e54e3fdd1b0.exe	29
PID 2628 wrote to memory of 780	2628	02b89444a1d633c44e1e9e54e3fdd1b0.exe	29
PID 2628 wrote to memory of 780	2628	02b89444a1d633c44e1e9e54e3fdd1b0.exe	29
PID 780 wrote to memory of 1216	780	02b89444a1d633c44e1e9e54e3fdd1b0.exe	30
PID 780 wrote to memory of 1216	780	02b89444a1d633c44e1e9e54e3fdd1b0.exe	30
PID 780 wrote to memory of 1216	780	02b89444a1d633c44e1e9e54e3fdd1b0.exe	30
PID 780 wrote to memory of 1216	780	02b89444a1d633c44e1e9e54e3fdd1b0.exe	30

C:\Users\Admin\AppData\Local\Temp\02b89444a1d633c44e1e9e54e3fdd1b0.exe
"C:\Users\Admin\AppData\Local\Temp\02b89444a1d633c44e1e9e54e3fdd1b0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Users\Admin\AppData\Local\Temp\02b89444a1d633c44e1e9e54e3fdd1b0.exe
  "C:\Users\Admin\AppData\Local\Temp\02b89444a1d633c44e1e9e54e3fdd1b0.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 36
    3⤵
    - Program crash
    PID:1216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/780-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/780-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/780-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2628-3-0x00000000741B0000-0x000000007489E000-memory.dmp

Filesize
6.9MB

Download
memory/2628-5-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/2628-6-0x00000000057E0000-0x000000000587A000-memory.dmp

Filesize
616KB

Download
memory/2628-7-0x0000000000B20000-0x0000000000B4E000-memory.dmp

Filesize
184KB

Download
memory/2628-4-0x0000000000330000-0x0000000000348000-memory.dmp

Filesize
96KB

Download
memory/2628-1-0x00000000741B0000-0x000000007489E000-memory.dmp

Filesize
6.9MB

Download
memory/2628-2-0x0000000004CF0000-0x0000000004D30000-memory.dmp

Filesize
256KB

Download
memory/2628-0-0x0000000000BA0000-0x0000000000C92000-memory.dmp

Filesize
968KB

Download
memory/2628-14-0x00000000741B0000-0x000000007489E000-memory.dmp

Filesize
6.9MB

Download