xloader | c5e2e6ca1132790699601f8a322bf098ecfc4001063a94ba0fb1861e73748fd7

Analysis

max time kernel
138s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 14:08

Target
3938c79cdaba4ed8ce678b0e80856648.exe
Size 259KB
Sample231231-rftdsadce5
SHA256 c5e2e6ca1132790699601f8a322bf098ecfc4001063a94ba0fb1861e73748fd7
MD5 3938c79cdaba4ed8ce678b0e80856648
SHA1 8cc115a4017d767b63d015551a265dc3419cf974
SHA512 047caf03cd00fb97fedbc517aec3de04df7decb12b0400dd34f5957a54cb6be9be00a3d750952b0750b2282dd06b854286638e834b87befa1d67168b248c4118
SSDEEP 6144:s4oBymq4yflwUHnhHxOVSXQXY3ETVbfE7nMkyo:qAmeT9kVScY3ETVbLkh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

Campaign

Decoy

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1700-2-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 632 set thread context of 1700	632	3938c79cdaba4ed8ce678b0e80856648.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1700	3938c79cdaba4ed8ce678b0e80856648.exe
1700	3938c79cdaba4ed8ce678b0e80856648.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
632	3938c79cdaba4ed8ce678b0e80856648.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1700	632	3938c79cdaba4ed8ce678b0e80856648.exe	91
PID 632 wrote to memory of 1700	632	3938c79cdaba4ed8ce678b0e80856648.exe	91
PID 632 wrote to memory of 1700	632	3938c79cdaba4ed8ce678b0e80856648.exe	91
PID 632 wrote to memory of 1700	632	3938c79cdaba4ed8ce678b0e80856648.exe	91

C:\Users\Admin\AppData\Local\Temp\3938c79cdaba4ed8ce678b0e80856648.exe
"C:\Users\Admin\AppData\Local\Temp\3938c79cdaba4ed8ce678b0e80856648.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Temp\3938c79cdaba4ed8ce678b0e80856648.exe
  "C:\Users\Admin\AppData\Local\Temp\3938c79cdaba4ed8ce678b0e80856648.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700

memory/632-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/632-1-0x0000000000460000-0x0000000000462000-memory.dmp

Download

memory/1700-2-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1700-3-0x0000000000A70000-0x0000000000DBA000-memory.dmp

Download