xloader | 4ef05b7079b1bf345f4759f1969a44faef7e2735e5e92d3f84d778b988d4287e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35b7cbb59dc298466c90222309a6adb2.exe
Size

860KB
MD5

35b7cbb59dc298466c90222309a6adb2
SHA1

989158aa5c040d59bb9ed71f7807414d7b2a0b9c
SHA256

4ef05b7079b1bf345f4759f1969a44faef7e2735e5e92d3f84d778b988d4287e
SHA512

6abede088a65b31a53679228e4685c3dba9e3eee799b198bd4a28e27cba88a01f5ea908227306df4a944b3bcf7d952d617ac4f7eb3e8c7c1149c828ab13132e6
SSDEEP

12288:+kjipAqZZoR65AXwgFvuSS1IBATKqyUhhJq+PpuYSx++0r7xibjcUmxVHeQU7:woR6qgjuWvjSx++0rGjI/eZ

Score

10^/10

xloader b8eu loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

b8eu

Decoy

ppslide.com

savorysinsation.com

camilaediego2021.com

rstrunk.net

xianshikanxiyang.club

1borefruit.com

ay-danil.club

xamangxcoax.club

waltonunderwood.com

laurabissell.com

laurawmorrow.com

albamauto.net

usamlb.com

theoyays.com

freeitproject.com

jijiservice.com

ukcarpetclean.com

wc399.com

xn--pskrtmebeton-dlbc.online

exclusivemerchantsolutions.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2856-12-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

35b7cbb59dc298466c90222309a6adb2.exe

description pid process target process

PID 2064 set thread context of 2856 2064 35b7cbb59dc298466c90222309a6adb2.exe 35b7cbb59dc298466c90222309a6adb2.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

35b7cbb59dc298466c90222309a6adb2.exe

pid process

2856 35b7cbb59dc298466c90222309a6adb2.exe

description	pid	process	target process
PID 2064 set thread context of 2856	2064	35b7cbb59dc298466c90222309a6adb2.exe	35b7cbb59dc298466c90222309a6adb2.exe

pid	process
2856	35b7cbb59dc298466c90222309a6adb2.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

35b7cbb59dc298466c90222309a6adb2.exe

description	pid	process	target process
PID 2064 wrote to memory of 2856	2064	35b7cbb59dc298466c90222309a6adb2.exe	35b7cbb59dc298466c90222309a6adb2.exe
PID 2064 wrote to memory of 2856	2064	35b7cbb59dc298466c90222309a6adb2.exe	35b7cbb59dc298466c90222309a6adb2.exe
PID 2064 wrote to memory of 2856	2064	35b7cbb59dc298466c90222309a6adb2.exe	35b7cbb59dc298466c90222309a6adb2.exe
PID 2064 wrote to memory of 2856	2064	35b7cbb59dc298466c90222309a6adb2.exe	35b7cbb59dc298466c90222309a6adb2.exe
PID 2064 wrote to memory of 2856	2064	35b7cbb59dc298466c90222309a6adb2.exe	35b7cbb59dc298466c90222309a6adb2.exe
PID 2064 wrote to memory of 2856	2064	35b7cbb59dc298466c90222309a6adb2.exe	35b7cbb59dc298466c90222309a6adb2.exe
PID 2064 wrote to memory of 2856	2064	35b7cbb59dc298466c90222309a6adb2.exe	35b7cbb59dc298466c90222309a6adb2.exe

C:\Users\Admin\AppData\Local\Temp\35b7cbb59dc298466c90222309a6adb2.exe
"C:\Users\Admin\AppData\Local\Temp\35b7cbb59dc298466c90222309a6adb2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2064

C:\Users\Admin\AppData\Local\Temp\35b7cbb59dc298466c90222309a6adb2.exe
"C:\Users\Admin\AppData\Local\Temp\35b7cbb59dc298466c90222309a6adb2.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2856

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-6-0x00000000059C0000-0x0000000005A5A000-memory.dmp

Filesize
616KB

Download
memory/2064-1-0x0000000074910000-0x0000000074FFE000-memory.dmp

Filesize
6.9MB

Download
memory/2064-2-0x0000000005010000-0x0000000005050000-memory.dmp

Filesize
256KB

Download
memory/2064-3-0x0000000000500000-0x000000000051A000-memory.dmp

Filesize
104KB

Download
memory/2064-4-0x0000000074910000-0x0000000074FFE000-memory.dmp

Filesize
6.9MB

Download
memory/2064-5-0x0000000005010000-0x0000000005050000-memory.dmp

Filesize
256KB

Download
memory/2064-0-0x0000000000D40000-0x0000000000E1E000-memory.dmp

Filesize
888KB

Download
memory/2064-7-0x00000000008E0000-0x0000000000910000-memory.dmp

Filesize
192KB

Download
memory/2064-13-0x0000000074910000-0x0000000074FFE000-memory.dmp

Filesize
6.9MB

Download
memory/2856-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2856-14-0x00000000009A0000-0x0000000000CA3000-memory.dmp

Filesize
3.0MB

Download
memory/2856-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2856-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2856-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download