xloader | 9f64df73b619cd708696983b9eb2dea834a4e6bf62128e28adb4d8d7b2f8143f

Analysis

max time kernel
144s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2024 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b6d021cb11a5e8abb0ab28e1ae0f711.exe
Size

629KB
MD5

4b6d021cb11a5e8abb0ab28e1ae0f711
SHA1

337e975f7d0f214da025e0b7d5b749dbbfcb5756
SHA256

9f64df73b619cd708696983b9eb2dea834a4e6bf62128e28adb4d8d7b2f8143f
SHA512

99a48435584de988a007e89d2f08fa662fce19cec8971aa320571b4a61f0632177c080a7e1ce5dc4114294e95cf2a396c79429307229842d9946e05ebd19f4e3
SSDEEP

12288:uqqv9wHM7iS/d348mtr1jCrS3yrm1pJp/P14F:u7wHPS/d3O5uSNhN4F

Score

10^/10

xloader wufn loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

wufn

Decoy

rsautoluxe.com

theroseofsharonsalon.com

singnema.com

nathanielwhite108.com

theforumonline.com

iqpt.info

joneshondaservice.com

fafene.com

solanohomebuyerclass.com

zwq.xyz

searchlakeconroehomes.com

briative.com

frystmor.city

systemofyouth.com

sctsmney.com

tv-safetrading.com

thesweetboy.com

occulusblu.com

pawsthemomentpetphotography.com

travelstipsguide.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral2/memory/3896-7-0x0000000005020000-0x0000000005032000-memory.dmp	CustAttr

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/864-12-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

4b6d021cb11a5e8abb0ab28e1ae0f711.exe

description pid process target process

PID 3896 set thread context of 864 3896 4b6d021cb11a5e8abb0ab28e1ae0f711.exe 4b6d021cb11a5e8abb0ab28e1ae0f711.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

4b6d021cb11a5e8abb0ab28e1ae0f711.exe

pid process

864 4b6d021cb11a5e8abb0ab28e1ae0f711.exe
864 4b6d021cb11a5e8abb0ab28e1ae0f711.exe
864 4b6d021cb11a5e8abb0ab28e1ae0f711.exe

description	pid	process	target process
PID 3896 set thread context of 864	3896	4b6d021cb11a5e8abb0ab28e1ae0f711.exe	4b6d021cb11a5e8abb0ab28e1ae0f711.exe

pid	process
864	4b6d021cb11a5e8abb0ab28e1ae0f711.exe
864	4b6d021cb11a5e8abb0ab28e1ae0f711.exe
864	4b6d021cb11a5e8abb0ab28e1ae0f711.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4b6d021cb11a5e8abb0ab28e1ae0f711.exe

description	pid	process	target process
PID 3896 wrote to memory of 864	3896	4b6d021cb11a5e8abb0ab28e1ae0f711.exe	4b6d021cb11a5e8abb0ab28e1ae0f711.exe
PID 3896 wrote to memory of 864	3896	4b6d021cb11a5e8abb0ab28e1ae0f711.exe	4b6d021cb11a5e8abb0ab28e1ae0f711.exe
PID 3896 wrote to memory of 864	3896	4b6d021cb11a5e8abb0ab28e1ae0f711.exe	4b6d021cb11a5e8abb0ab28e1ae0f711.exe
PID 3896 wrote to memory of 864	3896	4b6d021cb11a5e8abb0ab28e1ae0f711.exe	4b6d021cb11a5e8abb0ab28e1ae0f711.exe
PID 3896 wrote to memory of 864	3896	4b6d021cb11a5e8abb0ab28e1ae0f711.exe	4b6d021cb11a5e8abb0ab28e1ae0f711.exe
PID 3896 wrote to memory of 864	3896	4b6d021cb11a5e8abb0ab28e1ae0f711.exe	4b6d021cb11a5e8abb0ab28e1ae0f711.exe

C:\Users\Admin\AppData\Local\Temp\4b6d021cb11a5e8abb0ab28e1ae0f711.exe
"C:\Users\Admin\AppData\Local\Temp\4b6d021cb11a5e8abb0ab28e1ae0f711.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3896

C:\Users\Admin\AppData\Local\Temp\4b6d021cb11a5e8abb0ab28e1ae0f711.exe
"C:\Users\Admin\AppData\Local\Temp\4b6d021cb11a5e8abb0ab28e1ae0f711.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/864-15-0x0000000001830000-0x0000000001B7A000-memory.dmp

Filesize
3.3MB

Download
memory/3896-5-0x00000000056D0000-0x00000000056DA000-memory.dmp

Filesize
40KB

Download
memory/3896-3-0x0000000005620000-0x00000000056B2000-memory.dmp

Filesize
584KB

Download
memory/3896-4-0x00000000055E0000-0x00000000055F0000-memory.dmp

Filesize
64KB

Download
memory/3896-6-0x00000000058C0000-0x000000000595C000-memory.dmp

Filesize
624KB

Download
memory/3896-1-0x0000000000B70000-0x0000000000C12000-memory.dmp

Filesize
648KB

Download
memory/3896-7-0x0000000005020000-0x0000000005032000-memory.dmp

Filesize
72KB

Download
memory/3896-8-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download
memory/3896-9-0x00000000055E0000-0x00000000055F0000-memory.dmp

Filesize
64KB

Download
memory/3896-10-0x00000000082B0000-0x0000000008326000-memory.dmp

Filesize
472KB

Download
memory/3896-11-0x0000000008340000-0x0000000008370000-memory.dmp

Filesize
192KB

Download
memory/3896-2-0x0000000005B30000-0x00000000060D4000-memory.dmp

Filesize
5.6MB

Download
memory/3896-14-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download
memory/3896-0-0x0000000074800000-0x0000000074FB0000-memory.dmp

Filesize
7.7MB

Download