xloader | 24f5b6729bb4de4dfa691da018caf46ab4fdb01d08fd59d78422f67d833d7167

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21-01-2024 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6becb7e3e5c369e12bd11209a7e726ab.exe
Size

630KB
MD5

6becb7e3e5c369e12bd11209a7e726ab
SHA1

8fa87a66e5ba06327c731054b5dfe338a76fb1f3
SHA256

24f5b6729bb4de4dfa691da018caf46ab4fdb01d08fd59d78422f67d833d7167
SHA512

49c5846e3591653a731cf0b86205a95b74b6b8d31303e4372a5ec3b099bac92aa1d4908cec20159bc29928056ca9e502364d8eadc206370faaf12fa8a4e4c872
SSDEEP

12288:o8Ssuf6ikPjxdoCnZGuCVD3yPx9OqLuIv3iYimYw/aIWXOTkuQQ4WPiCU7mo5oFY:p/w6i0jxXEqmKuqnYwpWD7mo5oFCEkv

Score

10^/10

xloader wufn loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

wufn

Decoy

rsautoluxe.com

theroseofsharonsalon.com

singnema.com

nathanielwhite108.com

theforumonline.com

iqpt.info

joneshondaservice.com

fafene.com

solanohomebuyerclass.com

zwq.xyz

searchlakeconroehomes.com

briative.com

frystmor.city

systemofyouth.com

sctsmney.com

tv-safetrading.com

thesweetboy.com

occulusblu.com

pawsthemomentpetphotography.com

travelstipsguide.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/3004-3-0x0000000000340000-0x0000000000352000-memory.dmp	CustAttr

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2640-12-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

6becb7e3e5c369e12bd11209a7e726ab.exe

description pid process target process

PID 3004 set thread context of 2640 3004 6becb7e3e5c369e12bd11209a7e726ab.exe 6becb7e3e5c369e12bd11209a7e726ab.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

6becb7e3e5c369e12bd11209a7e726ab.exe

pid process

2640 6becb7e3e5c369e12bd11209a7e726ab.exe

description	pid	process	target process
PID 3004 set thread context of 2640	3004	6becb7e3e5c369e12bd11209a7e726ab.exe	6becb7e3e5c369e12bd11209a7e726ab.exe

pid	process
2640	6becb7e3e5c369e12bd11209a7e726ab.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

6becb7e3e5c369e12bd11209a7e726ab.exe

description	pid	process	target process
PID 3004 wrote to memory of 2640	3004	6becb7e3e5c369e12bd11209a7e726ab.exe	6becb7e3e5c369e12bd11209a7e726ab.exe
PID 3004 wrote to memory of 2640	3004	6becb7e3e5c369e12bd11209a7e726ab.exe	6becb7e3e5c369e12bd11209a7e726ab.exe
PID 3004 wrote to memory of 2640	3004	6becb7e3e5c369e12bd11209a7e726ab.exe	6becb7e3e5c369e12bd11209a7e726ab.exe
PID 3004 wrote to memory of 2640	3004	6becb7e3e5c369e12bd11209a7e726ab.exe	6becb7e3e5c369e12bd11209a7e726ab.exe
PID 3004 wrote to memory of 2640	3004	6becb7e3e5c369e12bd11209a7e726ab.exe	6becb7e3e5c369e12bd11209a7e726ab.exe
PID 3004 wrote to memory of 2640	3004	6becb7e3e5c369e12bd11209a7e726ab.exe	6becb7e3e5c369e12bd11209a7e726ab.exe
PID 3004 wrote to memory of 2640	3004	6becb7e3e5c369e12bd11209a7e726ab.exe	6becb7e3e5c369e12bd11209a7e726ab.exe

C:\Users\Admin\AppData\Local\Temp\6becb7e3e5c369e12bd11209a7e726ab.exe
"C:\Users\Admin\AppData\Local\Temp\6becb7e3e5c369e12bd11209a7e726ab.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3004

C:\Users\Admin\AppData\Local\Temp\6becb7e3e5c369e12bd11209a7e726ab.exe
"C:\Users\Admin\AppData\Local\Temp\6becb7e3e5c369e12bd11209a7e726ab.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2640

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2640-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2640-14-0x0000000000960000-0x0000000000C63000-memory.dmp

Filesize
3.0MB

Download
memory/2640-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2640-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2640-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3004-3-0x0000000000340000-0x0000000000352000-memory.dmp

Filesize
72KB

Download
memory/3004-6-0x0000000005860000-0x00000000058DC000-memory.dmp

Filesize
496KB

Download
memory/3004-7-0x00000000009F0000-0x0000000000A24000-memory.dmp

Filesize
208KB

Download
memory/3004-5-0x0000000004A20000-0x0000000004A60000-memory.dmp

Filesize
256KB

Download
memory/3004-4-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download
memory/3004-0-0x00000000012F0000-0x0000000001394000-memory.dmp

Filesize
656KB

Download
memory/3004-2-0x0000000004A20000-0x0000000004A60000-memory.dmp

Filesize
256KB

Download
memory/3004-13-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download
memory/3004-1-0x0000000073F30000-0x000000007461E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads