xloader | 78adbda6236e7a83a2e9507bc8d3a37efa2c5b7a4fcf215e08fa5726ac0731be

Analysis

max time kernel
157s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Remittance advice.exe
Size 252KB
Sample240113-g86jpsebg6
SHA256 657cab120187572696f7c42467fa8f996cba9a26c0a0583c528f49dc147823e5
MD5 a583767ab5f766830627c627d6d0a25b
SHA1 90d8650c12d57a6e46f13fbee87fa2ae4469bbfe
SHA512 73213c35ceb11d97112b6a9c98d206a66374b11d1bd6ccf96c7cf18096ac6b420810b4988eb3c8196042f0c7096a355b0170ff92bc655da91b5b85ad266a3f0e
SSDEEP 6144:jffa5uKiSYEhORRNEGiYa/ABsSJGKSCsN:eitEhJ7xA2tDN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xloader zy38 loader rat

Malware Config

Extracted

Family

xloader

Version

Campaign

zy38

Decoy

legacywritersacademy.net
globalforum-tm.com
jeffmackeyforjudge.com
lakenwatersports.gallery
zsgpbgsbh.icu
dwarkaluxuryhome.com
h7n9supply.com
findfromusstore.com
hemp8pharm.com
usacybersec.com
expressir.net
teknikfolyo.com
redlacedigital.com
tinhaynhat.com
social808.com
tecnoscript.com
mrsboddiesboutique.com
sjplot.com
soyo283.com
jayciedavid.com
20quoguestreet.com
gold-luster.com
traditionalcookingacademy.com
sportsrecoverysleeve.com
startoysexpress.com
woomanten.net
abrosnm3.com
ricknaya.net
anniversaryalbum.com
stvilla1999.com
dronedropoffs.com
ultravioletentertainment.com
bmwm3g80.com
collabamate.com
dach-realestate.com
bender-machine.com
peak-flourishhealthyfoodco.com
dg8845.club
saraelizabet.com
albg3atross.xyz
ivymusicmedia.com
xn--80abuhdrehhw.xn--p1acf
beatsbydboiclass.com
emilyshines.com
mychefforhire.com
sieuthithittuoisong.com
undividedmarketingsolution.com
sauerland-internet.com
allinonevts.com
bancaserfin.com
defiswaponline.com
renovalconsultancy.com
jamalion.tech
multifamilyinarizona.com
brixoven.com
t-c-o-t-c.com
arizonatexasleague.com
gaichu-kujotakumi.com
toptierink.com
bilda.store
etorquemotors.com
bestbluebuy.com
calm2020.club
babyboxbuy.com
babelteq-staging1.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/2996-3-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/2996-6-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/820-12-0x0000000000600000-0x0000000000629000-memory.dmp	xloader
behavioral2/memory/820-14-0x0000000000600000-0x0000000000629000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2168 set thread context of 2996	2168	Remittance advice.exe	90
PID 2996 set thread context of 3552	2996	Remittance advice.exe	23
PID 820 set thread context of 3552	820	cmd.exe	23

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
2996	Remittance advice.exe
2996	Remittance advice.exe
2996	Remittance advice.exe
2996	Remittance advice.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe
820	cmd.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2168	Remittance advice.exe
2996	Remittance advice.exe
2996	Remittance advice.exe
2996	Remittance advice.exe
820	cmd.exe
820	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	Remittance advice.exe
Token: SeDebugPrivilege	820	cmd.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3552	Explorer.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2996	2168	Remittance advice.exe	90
PID 2168 wrote to memory of 2996	2168	Remittance advice.exe	90
PID 2168 wrote to memory of 2996	2168	Remittance advice.exe	90
PID 2168 wrote to memory of 2996	2168	Remittance advice.exe	90
PID 3552 wrote to memory of 820	3552	Explorer.EXE	91
PID 3552 wrote to memory of 820	3552	Explorer.EXE	91
PID 3552 wrote to memory of 820	3552	Explorer.EXE	91
PID 820 wrote to memory of 3764	820	cmd.exe	92
PID 820 wrote to memory of 3764	820	cmd.exe	92
PID 820 wrote to memory of 3764	820	cmd.exe	92

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Users\Admin\AppData\Local\Temp\Remittance advice.exe
  "C:\Users\Admin\AppData\Local\Temp\Remittance advice.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\AppData\Local\Temp\Remittance advice.exe
    "C:\Users\Admin\AppData\Local\Temp\Remittance advice.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Remittance advice.exe"
    3⤵
    PID:3764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/820-16-0x0000000000CE0000-0x0000000000D6F000-memory.dmp

Download

memory/820-14-0x0000000000600000-0x0000000000629000-memory.dmp

Download

memory/820-11-0x0000000000170000-0x00000000001CA000-memory.dmp

Download

memory/820-13-0x0000000000F50000-0x000000000129A000-memory.dmp

Download

memory/820-12-0x0000000000600000-0x0000000000629000-memory.dmp

Download

memory/820-9-0x0000000000170000-0x00000000001CA000-memory.dmp

Download

memory/2168-2-0x0000000001630000-0x0000000001632000-memory.dmp

Download

memory/2168-1-0x0000000000CC0000-0x0000000000DC0000-memory.dmp

Download

memory/2996-7-0x00000000017D0000-0x00000000017E0000-memory.dmp

Download

memory/2996-6-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2996-4-0x00000000018F0000-0x0000000001C3A000-memory.dmp

Download

memory/2996-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3552-8-0x0000000008730000-0x0000000008886000-memory.dmp

Download

memory/3552-17-0x0000000008730000-0x0000000008886000-memory.dmp

Download

memory/3552-18-0x0000000008AB0000-0x0000000008BBD000-memory.dmp

Download

memory/3552-20-0x0000000008AB0000-0x0000000008BBD000-memory.dmp

Download

memory/3552-23-0x0000000008AB0000-0x0000000008BBD000-memory.dmp

Download