xloader | 511a94f3465fb39788f2c9a3c741b2f233ad6ebd6e47ab1225a1b8f34a463747

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52d7cccde88d979a77494e23a758faa2.exe
Size

727KB
MD5

52d7cccde88d979a77494e23a758faa2
SHA1

c14bceb7d7ccc2a815e964318174abea5eaae2db
SHA256

511a94f3465fb39788f2c9a3c741b2f233ad6ebd6e47ab1225a1b8f34a463747
SHA512

5ccbd91400207789135513d6e47aa7f4a0880374ab867907c219c9119bd630eaca248ac214ab5e6e81501e75b80c9d3eb9ced6faa7be5ec1c635f08d7810998c
SSDEEP

12288:F3EeNI3/LNE7gL/S1GoStWFnRT+wOyzDQW2Hpi3yvjef3/8Bt2NjFn:rI3/pEO/S1vSkFnRtOyzstpiivyf3UBC

Score

10^/10

xloader wufn loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

wufn

Decoy

rsautoluxe.com

theroseofsharonsalon.com

singnema.com

nathanielwhite108.com

theforumonline.com

iqpt.info

joneshondaservice.com

fafene.com

solanohomebuyerclass.com

zwq.xyz

searchlakeconroehomes.com

briative.com

frystmor.city

systemofyouth.com

sctsmney.com

tv-safetrading.com

thesweetboy.com

occulusblu.com

pawsthemomentpetphotography.com

travelstipsguide.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2488-12-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

52d7cccde88d979a77494e23a758faa2.exe

description pid process target process

PID 2220 set thread context of 2488 2220 52d7cccde88d979a77494e23a758faa2.exe 52d7cccde88d979a77494e23a758faa2.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

52d7cccde88d979a77494e23a758faa2.exe

pid process

2488 52d7cccde88d979a77494e23a758faa2.exe

description	pid	process	target process
PID 2220 set thread context of 2488	2220	52d7cccde88d979a77494e23a758faa2.exe	52d7cccde88d979a77494e23a758faa2.exe

pid	process
2488	52d7cccde88d979a77494e23a758faa2.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

52d7cccde88d979a77494e23a758faa2.exe

description	pid	process	target process
PID 2220 wrote to memory of 2488	2220	52d7cccde88d979a77494e23a758faa2.exe	52d7cccde88d979a77494e23a758faa2.exe
PID 2220 wrote to memory of 2488	2220	52d7cccde88d979a77494e23a758faa2.exe	52d7cccde88d979a77494e23a758faa2.exe
PID 2220 wrote to memory of 2488	2220	52d7cccde88d979a77494e23a758faa2.exe	52d7cccde88d979a77494e23a758faa2.exe
PID 2220 wrote to memory of 2488	2220	52d7cccde88d979a77494e23a758faa2.exe	52d7cccde88d979a77494e23a758faa2.exe
PID 2220 wrote to memory of 2488	2220	52d7cccde88d979a77494e23a758faa2.exe	52d7cccde88d979a77494e23a758faa2.exe
PID 2220 wrote to memory of 2488	2220	52d7cccde88d979a77494e23a758faa2.exe	52d7cccde88d979a77494e23a758faa2.exe
PID 2220 wrote to memory of 2488	2220	52d7cccde88d979a77494e23a758faa2.exe	52d7cccde88d979a77494e23a758faa2.exe

C:\Users\Admin\AppData\Local\Temp\52d7cccde88d979a77494e23a758faa2.exe
"C:\Users\Admin\AppData\Local\Temp\52d7cccde88d979a77494e23a758faa2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2220

C:\Users\Admin\AppData\Local\Temp\52d7cccde88d979a77494e23a758faa2.exe
"C:\Users\Admin\AppData\Local\Temp\52d7cccde88d979a77494e23a758faa2.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2488

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-6-0x00000000055B0000-0x0000000005650000-memory.dmp

Filesize
640KB

Download
memory/2220-0-0x0000000000B50000-0x0000000000C0A000-memory.dmp

Filesize
744KB

Download
memory/2220-2-0x0000000002160000-0x00000000021A0000-memory.dmp

Filesize
256KB

Download
memory/2220-3-0x0000000000300000-0x000000000031A000-memory.dmp

Filesize
104KB

Download
memory/2220-4-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2220-5-0x0000000002160000-0x00000000021A0000-memory.dmp

Filesize
256KB

Download
memory/2220-1-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2220-7-0x00000000021A0000-0x00000000021CE000-memory.dmp

Filesize
184KB

Download
memory/2220-13-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2488-14-0x0000000000C10000-0x0000000000F13000-memory.dmp

Filesize
3.0MB

Download
memory/2488-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2488-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2488-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2488-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download