xloader | 9fc3f0d5756cce9639d734d17ada931d3c83c20a6479d3ec0ea338d52137e1be

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

556389fdeca32b5417fa33656de427ed.exe
Size

474KB
MD5

556389fdeca32b5417fa33656de427ed
SHA1

d86c0643d5a41078cf47462918219f84e9cb4b5e
SHA256

9fc3f0d5756cce9639d734d17ada931d3c83c20a6479d3ec0ea338d52137e1be
SHA512

2cfeac65c5b0154497b0f1092f8f09e6316f9341c9f712bbf55021629b0cdec22686bfd4d47c5edc4bb1aea76385066a203995b05b931ebf5323b14e196febbd
SSDEEP

12288:T4Z2/0OI8c2nawCc0O5SzgnvCUsKDi7sxWa:TU2/bawW2XnvTi7s0a

Score

10^/10

xloader c7jh loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

c7jh

Decoy

frealz.com

janggipay.com

k12paymentceter.com

garnishclub.com

5975199.com

xyzenix.com

khspt.com

tccollection.net

electricscooter.parts

ouhongda.com

soltosoul.love

lentspace.com

mimik33.info

five-minute-diary.com

stanleyguzman.com

davidhidalgo.info

bfcalc.com

app-leadpulse.com

yogaforhumans.com

eaglerockinvest.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2944-11-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2976 set thread context of 2944	2976	556389fdeca32b5417fa33656de427ed.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2944	556389fdeca32b5417fa33656de427ed.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2944	2976	556389fdeca32b5417fa33656de427ed.exe	28
PID 2976 wrote to memory of 2944	2976	556389fdeca32b5417fa33656de427ed.exe	28
PID 2976 wrote to memory of 2944	2976	556389fdeca32b5417fa33656de427ed.exe	28
PID 2976 wrote to memory of 2944	2976	556389fdeca32b5417fa33656de427ed.exe	28
PID 2976 wrote to memory of 2944	2976	556389fdeca32b5417fa33656de427ed.exe	28
PID 2976 wrote to memory of 2944	2976	556389fdeca32b5417fa33656de427ed.exe	28
PID 2976 wrote to memory of 2944	2976	556389fdeca32b5417fa33656de427ed.exe	28

C:\Users\Admin\AppData\Local\Temp\556389fdeca32b5417fa33656de427ed.exe
"C:\Users\Admin\AppData\Local\Temp\556389fdeca32b5417fa33656de427ed.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\556389fdeca32b5417fa33656de427ed.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2944-13-0x0000000000800000-0x0000000000B03000-memory.dmp

Filesize
3.0MB

Download
memory/2944-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2944-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2944-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2944-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2976-2-0x00000000002D0000-0x0000000000310000-memory.dmp

Filesize
256KB

Download
memory/2976-1-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2976-0-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2976-3-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2976-4-0x00000000002D0000-0x0000000000310000-memory.dmp

Filesize
256KB

Download
memory/2976-12-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download