xloader | 9fc3f0d5756cce9639d734d17ada931d3c83c20a6479d3ec0ea338d52137e1be

Analysis

max time kernel
147s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

556389fdeca32b5417fa33656de427ed.exe
Size

474KB
MD5

556389fdeca32b5417fa33656de427ed
SHA1

d86c0643d5a41078cf47462918219f84e9cb4b5e
SHA256

9fc3f0d5756cce9639d734d17ada931d3c83c20a6479d3ec0ea338d52137e1be
SHA512

2cfeac65c5b0154497b0f1092f8f09e6316f9341c9f712bbf55021629b0cdec22686bfd4d47c5edc4bb1aea76385066a203995b05b931ebf5323b14e196febbd
SSDEEP

12288:T4Z2/0OI8c2nawCc0O5SzgnvCUsKDi7sxWa:TU2/bawW2XnvTi7s0a

Score

10^/10

xloader c7jh loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

c7jh

Decoy

frealz.com

janggipay.com

k12paymentceter.com

garnishclub.com

5975199.com

xyzenix.com

khspt.com

tccollection.net

electricscooter.parts

ouhongda.com

soltosoul.love

lentspace.com

mimik33.info

five-minute-diary.com

stanleyguzman.com

davidhidalgo.info

bfcalc.com

app-leadpulse.com

yogaforhumans.com

eaglerockinvest.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3612-4-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1552 set thread context of 3612	1552	556389fdeca32b5417fa33656de427ed.exe	102

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1552	556389fdeca32b5417fa33656de427ed.exe
1552	556389fdeca32b5417fa33656de427ed.exe
3612	556389fdeca32b5417fa33656de427ed.exe
3612	556389fdeca32b5417fa33656de427ed.exe
3612	556389fdeca32b5417fa33656de427ed.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1552	556389fdeca32b5417fa33656de427ed.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 2036	1552	556389fdeca32b5417fa33656de427ed.exe	101
PID 1552 wrote to memory of 2036	1552	556389fdeca32b5417fa33656de427ed.exe	101
PID 1552 wrote to memory of 2036	1552	556389fdeca32b5417fa33656de427ed.exe	101
PID 1552 wrote to memory of 3612	1552	556389fdeca32b5417fa33656de427ed.exe	102
PID 1552 wrote to memory of 3612	1552	556389fdeca32b5417fa33656de427ed.exe	102
PID 1552 wrote to memory of 3612	1552	556389fdeca32b5417fa33656de427ed.exe	102
PID 1552 wrote to memory of 3612	1552	556389fdeca32b5417fa33656de427ed.exe	102
PID 1552 wrote to memory of 3612	1552	556389fdeca32b5417fa33656de427ed.exe	102
PID 1552 wrote to memory of 3612	1552	556389fdeca32b5417fa33656de427ed.exe	102

C:\Users\Admin\AppData\Local\Temp\556389fdeca32b5417fa33656de427ed.exe
"C:\Users\Admin\AppData\Local\Temp\556389fdeca32b5417fa33656de427ed.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Users\Admin\AppData\Local\Temp\556389fdeca32b5417fa33656de427ed.exe
  "{path}"
  2⤵
  PID:2036
- C:\Users\Admin\AppData\Local\Temp\556389fdeca32b5417fa33656de427ed.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1552-0-0x0000000074C20000-0x00000000751D1000-memory.dmp

Filesize
5.7MB

Download
memory/1552-2-0x0000000001840000-0x0000000001850000-memory.dmp

Filesize
64KB

Download
memory/1552-1-0x0000000074C20000-0x00000000751D1000-memory.dmp

Filesize
5.7MB

Download
memory/1552-3-0x0000000074C20000-0x00000000751D1000-memory.dmp

Filesize
5.7MB

Download
memory/1552-6-0x0000000074C20000-0x00000000751D1000-memory.dmp

Filesize
5.7MB

Download
memory/3612-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3612-7-0x0000000001140000-0x000000000148A000-memory.dmp

Filesize
3.3MB

Download