xloader | dc86bed9797b57c00ce2cd7840954539f419475fb2bf9aacf577901acba82fdd

Analysis

max time kernel
137s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2024, 22:52

Target
93366adf8e19c623838e82a9ba9a4c81.exe
Size 483KB
Sample240205-2tjfvaabg2
SHA256 dc86bed9797b57c00ce2cd7840954539f419475fb2bf9aacf577901acba82fdd
MD5 93366adf8e19c623838e82a9ba9a4c81
SHA1 599f21a951fdd4b8a1bde2762d8795535877913c
SHA512 1c6d60241b1dcc0df03b1ecdbd0565121ddb1acd64dc20f6b22abfaf2f3e5c3e70c5285a6538c8e10976163211d1086089f9fc45b86f2029cd35cca5951191d0
SSDEEP 12288:nbfkuj579mHrrW8iRFOFa0p5pZ2snyZGmiAcoHrcLZ4kIyi:Yu1JmH3W8iRFOFa0p5pZfnSGmiarUZ4l
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

Campaign

Decoy

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2460-2-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 792 set thread context of 2460	792	93366adf8e19c623838e82a9ba9a4c81.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2460	93366adf8e19c623838e82a9ba9a4c81.exe
2460	93366adf8e19c623838e82a9ba9a4c81.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
792	93366adf8e19c623838e82a9ba9a4c81.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 2460	792	93366adf8e19c623838e82a9ba9a4c81.exe	83
PID 792 wrote to memory of 2460	792	93366adf8e19c623838e82a9ba9a4c81.exe	83
PID 792 wrote to memory of 2460	792	93366adf8e19c623838e82a9ba9a4c81.exe	83
PID 792 wrote to memory of 2460	792	93366adf8e19c623838e82a9ba9a4c81.exe	83

C:\Users\Admin\AppData\Local\Temp\93366adf8e19c623838e82a9ba9a4c81.exe
"C:\Users\Admin\AppData\Local\Temp\93366adf8e19c623838e82a9ba9a4c81.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:792
- C:\Users\Admin\AppData\Local\Temp\93366adf8e19c623838e82a9ba9a4c81.exe
  "C:\Users\Admin\AppData\Local\Temp\93366adf8e19c623838e82a9ba9a4c81.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2460

memory/792-0-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/792-1-0x00000000021C0000-0x00000000021C2000-memory.dmp

Download

memory/792-3-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/2460-2-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2460-5-0x0000000000990000-0x0000000000CDA000-memory.dmp

Download