xloader | 4c1b38391ab198fb0e2c7050a8951e65efbc818991fb710f6deeb2c76a54c734

Analysis

max time kernel
92s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2024 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92f15ca5167c47451b44f08c4eb0d5a4.exe
Size

1.3MB
MD5

92f15ca5167c47451b44f08c4eb0d5a4
SHA1

aaa650fdf71978a3143a5a8c85a57a5518c6c8e1
SHA256

4c1b38391ab198fb0e2c7050a8951e65efbc818991fb710f6deeb2c76a54c734
SHA512

6dbc42456fe5a43f0e6c27716bef93365e4642301014589e60276b756f1877faf7e056aa3bcd3e36d27b8bbcabcac68bda89e491d765fec5379e24c0214bf19d
SSDEEP

24576:MoSd76DOXfx8Dgyfx8DgFwUUNmvNTiP4t5MwDZF2L:+d76e58Dgy58DgFw2fTZQ

Score

10^/10

xloader ipa8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ipa8

Decoy

royalposhpups.com

univa.world

lanerbo.com

shopbabygo.com

theutahhomestore.com

serialmixer.icu

linfeiya.com

xn--12cg3de5c2eb5cyi.com

am-conseil-communication.com

dailygame168.com

therightmilitia.com

visions-agency.com

mapopi.com

frugallyketo.com

guapandglo.com

54w-x126v.net

your-health-kick.com

blockchainhub360.com

registernowhd.xyz

votekellykitashima.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1556-12-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

92f15ca5167c47451b44f08c4eb0d5a4.exe

description pid process target process

PID 3088 set thread context of 1556 3088 92f15ca5167c47451b44f08c4eb0d5a4.exe 92f15ca5167c47451b44f08c4eb0d5a4.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

92f15ca5167c47451b44f08c4eb0d5a4.exe

pid process

1556 92f15ca5167c47451b44f08c4eb0d5a4.exe
1556 92f15ca5167c47451b44f08c4eb0d5a4.exe

description	pid	process	target process
PID 3088 set thread context of 1556	3088	92f15ca5167c47451b44f08c4eb0d5a4.exe	92f15ca5167c47451b44f08c4eb0d5a4.exe

pid	process
1556	92f15ca5167c47451b44f08c4eb0d5a4.exe
1556	92f15ca5167c47451b44f08c4eb0d5a4.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

92f15ca5167c47451b44f08c4eb0d5a4.exe

description	pid	process	target process
PID 3088 wrote to memory of 1556	3088	92f15ca5167c47451b44f08c4eb0d5a4.exe	92f15ca5167c47451b44f08c4eb0d5a4.exe
PID 3088 wrote to memory of 1556	3088	92f15ca5167c47451b44f08c4eb0d5a4.exe	92f15ca5167c47451b44f08c4eb0d5a4.exe
PID 3088 wrote to memory of 1556	3088	92f15ca5167c47451b44f08c4eb0d5a4.exe	92f15ca5167c47451b44f08c4eb0d5a4.exe
PID 3088 wrote to memory of 1556	3088	92f15ca5167c47451b44f08c4eb0d5a4.exe	92f15ca5167c47451b44f08c4eb0d5a4.exe
PID 3088 wrote to memory of 1556	3088	92f15ca5167c47451b44f08c4eb0d5a4.exe	92f15ca5167c47451b44f08c4eb0d5a4.exe
PID 3088 wrote to memory of 1556	3088	92f15ca5167c47451b44f08c4eb0d5a4.exe	92f15ca5167c47451b44f08c4eb0d5a4.exe

C:\Users\Admin\AppData\Local\Temp\92f15ca5167c47451b44f08c4eb0d5a4.exe
"C:\Users\Admin\AppData\Local\Temp\92f15ca5167c47451b44f08c4eb0d5a4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Users\Admin\AppData\Local\Temp\92f15ca5167c47451b44f08c4eb0d5a4.exe
  "C:\Users\Admin\AppData\Local\Temp\92f15ca5167c47451b44f08c4eb0d5a4.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1556-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1556-16-0x0000000001110000-0x000000000145A000-memory.dmp

Filesize
3.3MB

Download
memory/1556-15-0x0000000001110000-0x000000000145A000-memory.dmp

Filesize
3.3MB

Download
memory/3088-4-0x00000000055F0000-0x0000000005600000-memory.dmp

Filesize
64KB

Download
memory/3088-1-0x0000000074A50000-0x0000000075200000-memory.dmp

Filesize
7.7MB

Download
memory/3088-6-0x0000000005710000-0x00000000057AC000-memory.dmp

Filesize
624KB

Download
memory/3088-5-0x0000000005550000-0x000000000555A000-memory.dmp

Filesize
40KB

Download
memory/3088-7-0x0000000004E20000-0x0000000004E32000-memory.dmp

Filesize
72KB

Download
memory/3088-8-0x0000000074A50000-0x0000000075200000-memory.dmp

Filesize
7.7MB

Download
memory/3088-9-0x00000000055F0000-0x0000000005600000-memory.dmp

Filesize
64KB

Download
memory/3088-10-0x0000000009290000-0x000000000932E000-memory.dmp

Filesize
632KB

Download
memory/3088-11-0x0000000007010000-0x000000000703E000-memory.dmp

Filesize
184KB

Download
memory/3088-3-0x00000000053A0000-0x0000000005432000-memory.dmp

Filesize
584KB

Download
memory/3088-14-0x0000000074A50000-0x0000000075200000-memory.dmp

Filesize
7.7MB

Download
memory/3088-2-0x0000000005860000-0x0000000005E04000-memory.dmp

Filesize
5.6MB

Download
memory/3088-0-0x0000000000870000-0x00000000009BA000-memory.dmp

Filesize
1.3MB

Download