xloader | abb184e2afdbbc65327aa2ce9eb3075cade745126b8da118abbebc0c5ad8b7e5

Analysis

max time kernel
143s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2024 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

436e92098a95e694d9c7d6d63e522e3a.exe
Size

255KB
MD5

436e92098a95e694d9c7d6d63e522e3a
SHA1

8811636dd2e2b6b5fd32cd2bf0ad3c277718db4b
SHA256

abb184e2afdbbc65327aa2ce9eb3075cade745126b8da118abbebc0c5ad8b7e5
SHA512

47a12ec4b32b9687d7da340d7adeabe1f240a175c3c00f646860efa2126ad324fc40cd3428d54e15ef4c14ed2d380b10162e2f60f895ca5f4678d2da18422032
SSDEEP

6144:WLWfVPtZVWre+os+zrWRqXbh2FKhpo2ax3eOUEJUBJND:bfVVWrzR+uR4bhm0pofNUEJUBD

Score

10^/10

xloader b6a4 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

b6a4

Decoy

reviewsresolutions.com

binhminhgardenshophouse.com

nebulacom.com

kadhambaristudio.com

viltoom.club

supmomma.com

tjszxddc.com

darlingmemories.com

hyperultrapure.com

vibembrio.com

reallycoolmask.com

cumbukita.com

brian-newby.com

abstractaccessories.com

marykinky.com

minnesotareversemtgloans.com

prasetlement.com

xplpgi.com

xn--gdask-y7a.com

uababaseball.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4260-3-0x0000000000350000-0x0000000000378000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

436e92098a95e694d9c7d6d63e522e3a.exe

description pid process target process

PID 1908 set thread context of 4260 1908 436e92098a95e694d9c7d6d63e522e3a.exe 436e92098a95e694d9c7d6d63e522e3a.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

436e92098a95e694d9c7d6d63e522e3a.exe

pid process

4260 436e92098a95e694d9c7d6d63e522e3a.exe
4260 436e92098a95e694d9c7d6d63e522e3a.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

436e92098a95e694d9c7d6d63e522e3a.exe

pid process

1908 436e92098a95e694d9c7d6d63e522e3a.exe
1908 436e92098a95e694d9c7d6d63e522e3a.exe

description	pid	process	target process
PID 1908 set thread context of 4260	1908	436e92098a95e694d9c7d6d63e522e3a.exe	436e92098a95e694d9c7d6d63e522e3a.exe

pid	process
4260	436e92098a95e694d9c7d6d63e522e3a.exe
4260	436e92098a95e694d9c7d6d63e522e3a.exe

pid	process
1908	436e92098a95e694d9c7d6d63e522e3a.exe
1908	436e92098a95e694d9c7d6d63e522e3a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

436e92098a95e694d9c7d6d63e522e3a.exe

description	pid	process	target process
PID 1908 wrote to memory of 4260	1908	436e92098a95e694d9c7d6d63e522e3a.exe	436e92098a95e694d9c7d6d63e522e3a.exe
PID 1908 wrote to memory of 4260	1908	436e92098a95e694d9c7d6d63e522e3a.exe	436e92098a95e694d9c7d6d63e522e3a.exe
PID 1908 wrote to memory of 4260	1908	436e92098a95e694d9c7d6d63e522e3a.exe	436e92098a95e694d9c7d6d63e522e3a.exe
PID 1908 wrote to memory of 4260	1908	436e92098a95e694d9c7d6d63e522e3a.exe	436e92098a95e694d9c7d6d63e522e3a.exe

C:\Users\Admin\AppData\Local\Temp\436e92098a95e694d9c7d6d63e522e3a.exe
"C:\Users\Admin\AppData\Local\Temp\436e92098a95e694d9c7d6d63e522e3a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1908

C:\Users\Admin\AppData\Local\Temp\436e92098a95e694d9c7d6d63e522e3a.exe
"C:\Users\Admin\AppData\Local\Temp\436e92098a95e694d9c7d6d63e522e3a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4260

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1908-1-0x0000000000E60000-0x0000000000F60000-memory.dmp

Filesize
1024KB

Download
memory/1908-2-0x00000000015D0000-0x00000000015D2000-memory.dmp

Filesize
8KB

Download
memory/4260-3-0x0000000000350000-0x0000000000378000-memory.dmp

Filesize
160KB

Download
memory/4260-6-0x0000000000CE0000-0x000000000102A000-memory.dmp

Filesize
3.3MB

Download