xloader | 8dec5ed95d3ca077bb1c2695074877a7160f97960df22a119d9f2debfb18dc0b

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 19:55

Target
7b237f5378187373a67114d738cedc4c.exe
Size 679KB
Sample240127-ynjb4scgdr
SHA256 8dec5ed95d3ca077bb1c2695074877a7160f97960df22a119d9f2debfb18dc0b
MD5 7b237f5378187373a67114d738cedc4c
SHA1 56341c81d80a8cb85c7b8ad0fe65a64572860ffe
SHA512 1065b5f7ccd2cff48cf80e62c7840cc81b3cd9f863cc3eabdc5ea47a6d1d69ce910273c589d5e355bb6519fb7a0c25ac15317a3f1053fe519ae1497c3b23db27
SSDEEP 12288:iKMJZ4sLubXEqY+o6iYmTAvsm4HHeXg/8V:j0ZhLuAqYz6UTAd4HHT/e
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

Campaign

Decoy

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4868-3-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1204 set thread context of 4868	1204	7b237f5378187373a67114d738cedc4c.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4868	7b237f5378187373a67114d738cedc4c.exe
4868	7b237f5378187373a67114d738cedc4c.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1204	7b237f5378187373a67114d738cedc4c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 4868	1204	7b237f5378187373a67114d738cedc4c.exe	85
PID 1204 wrote to memory of 4868	1204	7b237f5378187373a67114d738cedc4c.exe	85
PID 1204 wrote to memory of 4868	1204	7b237f5378187373a67114d738cedc4c.exe	85
PID 1204 wrote to memory of 4868	1204	7b237f5378187373a67114d738cedc4c.exe	85

C:\Users\Admin\AppData\Local\Temp\7b237f5378187373a67114d738cedc4c.exe
"C:\Users\Admin\AppData\Local\Temp\7b237f5378187373a67114d738cedc4c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\7b237f5378187373a67114d738cedc4c.exe
  "C:\Users\Admin\AppData\Local\Temp\7b237f5378187373a67114d738cedc4c.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868

memory/1204-1-0x0000000000E00000-0x0000000000F00000-memory.dmp

Download

memory/1204-2-0x00000000010D0000-0x00000000010D2000-memory.dmp

Download

memory/4868-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4868-4-0x0000000001050000-0x000000000139A000-memory.dmp

Download