xloader | d53bae4b5ce931f64224d180b42eda418516d524ae0623571069c6bc30845fa3

Analysis

max time kernel
144s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 16:57

Target
0bb660af76cd316fd2dae5a66506a1a7.exe
Size 506KB
Sample231230-vggcdsafbn
SHA256 d53bae4b5ce931f64224d180b42eda418516d524ae0623571069c6bc30845fa3
MD5 0bb660af76cd316fd2dae5a66506a1a7
SHA1 1765a7f9b76bc22b89a5d74997a54c5c5be28450
SHA512 0551c44663ecc9b5ce8c27999c7b22067fee4c4769a906f42341e666688807d01f7abdad65f6159e0c6104bde20dde028e49496b065bf8147e54da71ae334e1b
SSDEEP 12288:S7ixuBYYUltDe9syZLZQ5+SDW1afioyS3+lpq4e7:S7ixufUbCsKLZQ5+SDW1di1/7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

Campaign

Decoy

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4064-3-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3840 set thread context of 4064	3840	0bb660af76cd316fd2dae5a66506a1a7.exe	89

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4064	0bb660af76cd316fd2dae5a66506a1a7.exe
4064	0bb660af76cd316fd2dae5a66506a1a7.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3840	0bb660af76cd316fd2dae5a66506a1a7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 4064	3840	0bb660af76cd316fd2dae5a66506a1a7.exe	89
PID 3840 wrote to memory of 4064	3840	0bb660af76cd316fd2dae5a66506a1a7.exe	89
PID 3840 wrote to memory of 4064	3840	0bb660af76cd316fd2dae5a66506a1a7.exe	89
PID 3840 wrote to memory of 4064	3840	0bb660af76cd316fd2dae5a66506a1a7.exe	89

C:\Users\Admin\AppData\Local\Temp\0bb660af76cd316fd2dae5a66506a1a7.exe
"C:\Users\Admin\AppData\Local\Temp\0bb660af76cd316fd2dae5a66506a1a7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Users\Admin\AppData\Local\Temp\0bb660af76cd316fd2dae5a66506a1a7.exe
  "C:\Users\Admin\AppData\Local\Temp\0bb660af76cd316fd2dae5a66506a1a7.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4064

memory/3840-1-0x00000000008D0000-0x00000000009D0000-memory.dmp

Download

memory/3840-2-0x0000000001390000-0x0000000001392000-memory.dmp

Download

memory/4064-3-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4064-4-0x00000000014A0000-0x00000000017EA000-memory.dmp

Download