xloader | 4c1b38391ab198fb0e2c7050a8951e65efbc818991fb710f6deeb2c76a54c734

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-02-2024 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92f15ca5167c47451b44f08c4eb0d5a4.exe
Size

1.3MB
MD5

92f15ca5167c47451b44f08c4eb0d5a4
SHA1

aaa650fdf71978a3143a5a8c85a57a5518c6c8e1
SHA256

4c1b38391ab198fb0e2c7050a8951e65efbc818991fb710f6deeb2c76a54c734
SHA512

6dbc42456fe5a43f0e6c27716bef93365e4642301014589e60276b756f1877faf7e056aa3bcd3e36d27b8bbcabcac68bda89e491d765fec5379e24c0214bf19d
SSDEEP

24576:MoSd76DOXfx8Dgyfx8DgFwUUNmvNTiP4t5MwDZF2L:+d76e58Dgy58DgFw2fTZQ

Score

10^/10

xloader ipa8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ipa8

Decoy

royalposhpups.com

univa.world

lanerbo.com

shopbabygo.com

theutahhomestore.com

serialmixer.icu

linfeiya.com

xn--12cg3de5c2eb5cyi.com

am-conseil-communication.com

dailygame168.com

therightmilitia.com

visions-agency.com

mapopi.com

frugallyketo.com

guapandglo.com

54w-x126v.net

your-health-kick.com

blockchainhub360.com

registernowhd.xyz

votekellykitashima.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2560-14-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

92f15ca5167c47451b44f08c4eb0d5a4.exe

description pid process target process

PID 776 set thread context of 2560 776 92f15ca5167c47451b44f08c4eb0d5a4.exe 92f15ca5167c47451b44f08c4eb0d5a4.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

92f15ca5167c47451b44f08c4eb0d5a4.exe

pid process

2560 92f15ca5167c47451b44f08c4eb0d5a4.exe

description	pid	process	target process
PID 776 set thread context of 2560	776	92f15ca5167c47451b44f08c4eb0d5a4.exe	92f15ca5167c47451b44f08c4eb0d5a4.exe

pid	process
2560	92f15ca5167c47451b44f08c4eb0d5a4.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

92f15ca5167c47451b44f08c4eb0d5a4.exe

description	pid	process	target process
PID 776 wrote to memory of 2560	776	92f15ca5167c47451b44f08c4eb0d5a4.exe	92f15ca5167c47451b44f08c4eb0d5a4.exe
PID 776 wrote to memory of 2560	776	92f15ca5167c47451b44f08c4eb0d5a4.exe	92f15ca5167c47451b44f08c4eb0d5a4.exe
PID 776 wrote to memory of 2560	776	92f15ca5167c47451b44f08c4eb0d5a4.exe	92f15ca5167c47451b44f08c4eb0d5a4.exe
PID 776 wrote to memory of 2560	776	92f15ca5167c47451b44f08c4eb0d5a4.exe	92f15ca5167c47451b44f08c4eb0d5a4.exe
PID 776 wrote to memory of 2560	776	92f15ca5167c47451b44f08c4eb0d5a4.exe	92f15ca5167c47451b44f08c4eb0d5a4.exe
PID 776 wrote to memory of 2560	776	92f15ca5167c47451b44f08c4eb0d5a4.exe	92f15ca5167c47451b44f08c4eb0d5a4.exe
PID 776 wrote to memory of 2560	776	92f15ca5167c47451b44f08c4eb0d5a4.exe	92f15ca5167c47451b44f08c4eb0d5a4.exe

C:\Users\Admin\AppData\Local\Temp\92f15ca5167c47451b44f08c4eb0d5a4.exe
"C:\Users\Admin\AppData\Local\Temp\92f15ca5167c47451b44f08c4eb0d5a4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:776

C:\Users\Admin\AppData\Local\Temp\92f15ca5167c47451b44f08c4eb0d5a4.exe
"C:\Users\Admin\AppData\Local\Temp\92f15ca5167c47451b44f08c4eb0d5a4.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2560

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/776-6-0x0000000006FD0000-0x000000000706E000-memory.dmp

Filesize
632KB

Download
memory/776-0-0x0000000000DE0000-0x0000000000F2A000-memory.dmp

Filesize
1.3MB

Download
memory/776-2-0x0000000000C00000-0x0000000000C40000-memory.dmp

Filesize
256KB

Download
memory/776-3-0x0000000000800000-0x0000000000812000-memory.dmp

Filesize
72KB

Download
memory/776-4-0x00000000741D0000-0x00000000748BE000-memory.dmp

Filesize
6.9MB

Download
memory/776-5-0x0000000000C00000-0x0000000000C40000-memory.dmp

Filesize
256KB

Download
memory/776-1-0x00000000741D0000-0x00000000748BE000-memory.dmp

Filesize
6.9MB

Download
memory/776-7-0x0000000000A00000-0x0000000000A2E000-memory.dmp

Filesize
184KB

Download
memory/776-15-0x00000000741D0000-0x00000000748BE000-memory.dmp

Filesize
6.9MB

Download
memory/2560-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2560-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2560-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2560-16-0x0000000000930000-0x0000000000C33000-memory.dmp

Filesize
3.0MB

Download
memory/2560-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download