xloader | d7abd3634174ad687ef4153f268667361c7177b73871c7dbd296659d918e0d36

Analysis

max time kernel
146s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 05:08

Target
0f9ed47f1ffe3b1cd242b7872f4ce341.exe
Size 260KB
Sample231230-fs2p5sbfap
SHA256 d7abd3634174ad687ef4153f268667361c7177b73871c7dbd296659d918e0d36
MD5 0f9ed47f1ffe3b1cd242b7872f4ce341
SHA1 37c2b669d727b1aec796644c1f4f884f0ad86944
SHA512 b739a86c7ba735fe40e7630603519d2383b7615ab5c96780138455496da804e19a3d8b3228afb98403b84cdf9b769b064af899f173dd044bd313b1e32d4a18bf
SSDEEP 6144:wM0XSGZqaz2EZTSBXSQOpkAVNGo2c/FejeqlbgMF:wfSGZzztOBXcpk2GogN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

Campaign

Decoy

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1136-2-0x0000000000440000-0x0000000000469000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1216 set thread context of 1136	1216	0f9ed47f1ffe3b1cd242b7872f4ce341.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1136	0f9ed47f1ffe3b1cd242b7872f4ce341.exe
1136	0f9ed47f1ffe3b1cd242b7872f4ce341.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1216	0f9ed47f1ffe3b1cd242b7872f4ce341.exe
1216	0f9ed47f1ffe3b1cd242b7872f4ce341.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1136	1216	0f9ed47f1ffe3b1cd242b7872f4ce341.exe	91
PID 1216 wrote to memory of 1136	1216	0f9ed47f1ffe3b1cd242b7872f4ce341.exe	91
PID 1216 wrote to memory of 1136	1216	0f9ed47f1ffe3b1cd242b7872f4ce341.exe	91
PID 1216 wrote to memory of 1136	1216	0f9ed47f1ffe3b1cd242b7872f4ce341.exe	91

C:\Users\Admin\AppData\Local\Temp\0f9ed47f1ffe3b1cd242b7872f4ce341.exe
"C:\Users\Admin\AppData\Local\Temp\0f9ed47f1ffe3b1cd242b7872f4ce341.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\0f9ed47f1ffe3b1cd242b7872f4ce341.exe
  "C:\Users\Admin\AppData\Local\Temp\0f9ed47f1ffe3b1cd242b7872f4ce341.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1136

memory/1136-2-0x0000000000440000-0x0000000000469000-memory.dmp

Download

memory/1136-5-0x0000000000BF0000-0x0000000000F3A000-memory.dmp

Download

memory/1216-1-0x0000000002A70000-0x0000000002A72000-memory.dmp

Download

memory/1216-0-0x00000000004B0000-0x00000000004BE000-memory.dmp

Download