xloader | a28c1aa7b9aae861040aea6d14c8d2f860101502a18f7d8d8dc7592fde73a31a

Analysis

max time kernel
120s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-01-2024 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e33655754e13782626f4b2282a8264d.exe
Size

683KB
MD5

6e33655754e13782626f4b2282a8264d
SHA1

0da7d6be6e434642c0dd70fec884c6fe50c2aeb4
SHA256

a28c1aa7b9aae861040aea6d14c8d2f860101502a18f7d8d8dc7592fde73a31a
SHA512

918321e3b33ae0801736febdb2268204e87bb81282652404b212bdd02907289b7f4c07b5866f4230b7fb629b54cf9b70529bf7d29a1b44fba7fa827cd1a494d0
SSDEEP

12288:3cuFHocVk5S+LwyamUunc28UNnc5rm6UUdjpM3YLzkE2zm4OOX2A2Hmu:313C1LwzmbncnAnc5rm6Uj3YB2tD

Score

10^/10

xloader wufn loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

wufn

Decoy

rsautoluxe.com

theroseofsharonsalon.com

singnema.com

nathanielwhite108.com

theforumonline.com

iqpt.info

joneshondaservice.com

fafene.com

solanohomebuyerclass.com

zwq.xyz

searchlakeconroehomes.com

briative.com

frystmor.city

systemofyouth.com

sctsmney.com

tv-safetrading.com

thesweetboy.com

occulusblu.com

pawsthemomentpetphotography.com

travelstipsguide.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2976-15-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

6e33655754e13782626f4b2282a8264d.exe

description pid process target process

PID 2228 set thread context of 2976 2228 6e33655754e13782626f4b2282a8264d.exe 6e33655754e13782626f4b2282a8264d.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

6e33655754e13782626f4b2282a8264d.exe

pid process

2976 6e33655754e13782626f4b2282a8264d.exe

description	pid	process	target process
PID 2228 set thread context of 2976	2228	6e33655754e13782626f4b2282a8264d.exe	6e33655754e13782626f4b2282a8264d.exe

pid	process
2976	6e33655754e13782626f4b2282a8264d.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

6e33655754e13782626f4b2282a8264d.exe

description	pid	process	target process
PID 2228 wrote to memory of 2976	2228	6e33655754e13782626f4b2282a8264d.exe	6e33655754e13782626f4b2282a8264d.exe
PID 2228 wrote to memory of 2976	2228	6e33655754e13782626f4b2282a8264d.exe	6e33655754e13782626f4b2282a8264d.exe
PID 2228 wrote to memory of 2976	2228	6e33655754e13782626f4b2282a8264d.exe	6e33655754e13782626f4b2282a8264d.exe
PID 2228 wrote to memory of 2976	2228	6e33655754e13782626f4b2282a8264d.exe	6e33655754e13782626f4b2282a8264d.exe
PID 2228 wrote to memory of 2976	2228	6e33655754e13782626f4b2282a8264d.exe	6e33655754e13782626f4b2282a8264d.exe
PID 2228 wrote to memory of 2976	2228	6e33655754e13782626f4b2282a8264d.exe	6e33655754e13782626f4b2282a8264d.exe
PID 2228 wrote to memory of 2976	2228	6e33655754e13782626f4b2282a8264d.exe	6e33655754e13782626f4b2282a8264d.exe

C:\Users\Admin\AppData\Local\Temp\6e33655754e13782626f4b2282a8264d.exe
"C:\Users\Admin\AppData\Local\Temp\6e33655754e13782626f4b2282a8264d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2228

C:\Users\Admin\AppData\Local\Temp\6e33655754e13782626f4b2282a8264d.exe
"C:\Users\Admin\AppData\Local\Temp\6e33655754e13782626f4b2282a8264d.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2976

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2228-6-0x00000000005A0000-0x00000000005E0000-memory.dmp

Filesize
256KB

Download
memory/2228-8-0x0000000002190000-0x00000000021C6000-memory.dmp

Filesize
216KB

Download
memory/2228-2-0x0000000004470000-0x00000000044FA000-memory.dmp

Filesize
552KB

Download
memory/2228-3-0x00000000005A0000-0x00000000005E0000-memory.dmp

Filesize
256KB

Download
memory/2228-4-0x0000000000570000-0x0000000000588000-memory.dmp

Filesize
96KB

Download
memory/2228-5-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download
memory/2228-1-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download
memory/2228-7-0x00000000050D0000-0x0000000005172000-memory.dmp

Filesize
648KB

Download
memory/2228-0-0x0000000000920000-0x00000000009D2000-memory.dmp

Filesize
712KB

Download
memory/2228-16-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download
memory/2976-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2976-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2976-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2976-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2976-17-0x00000000009E0000-0x0000000000CE3000-memory.dmp

Filesize
3.0MB

Download