xloader | aca5906ce824a479fd3899591055ce426b2c2000ccf4c4b2f7ee97c21a1edb53

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
16-02-2024 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ff69cfd1ba247337859693dc4f23908.exe
Size

390KB
MD5

9ff69cfd1ba247337859693dc4f23908
SHA1

d89eb9221a63e31ccfdf160271ba9d6c546678f0
SHA256

aca5906ce824a479fd3899591055ce426b2c2000ccf4c4b2f7ee97c21a1edb53
SHA512

e432d5a205563b230a55836f8b759aaa76f220b9334c48f6601b971ea4511424d34b24a607eff6067a7d1173bd956f642cf333246afd483fa3fd412dc4b61bfa
SSDEEP

6144:sOKO3Dtzcy6i85tGxD/kpkAh71jHaJEx/v9ha:RKO3Dtzi7hM8nm

Score

10^/10

xloader b6a4 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

b6a4

Decoy

reviewsresolutions.com

binhminhgardenshophouse.com

nebulacom.com

kadhambaristudio.com

viltoom.club

supmomma.com

tjszxddc.com

darlingmemories.com

hyperultrapure.com

vibembrio.com

reallycoolmask.com

cumbukita.com

brian-newby.com

abstractaccessories.com

marykinky.com

minnesotareversemtgloans.com

prasetlement.com

xplpgi.com

xn--gdask-y7a.com

uababaseball.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2040-2-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

9ff69cfd1ba247337859693dc4f23908.exe

description pid process target process

PID 1648 set thread context of 2040 1648 9ff69cfd1ba247337859693dc4f23908.exe 9ff69cfd1ba247337859693dc4f23908.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

9ff69cfd1ba247337859693dc4f23908.exe

pid process

2040 9ff69cfd1ba247337859693dc4f23908.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

9ff69cfd1ba247337859693dc4f23908.exe

pid process

1648 9ff69cfd1ba247337859693dc4f23908.exe

description	pid	process	target process
PID 1648 set thread context of 2040	1648	9ff69cfd1ba247337859693dc4f23908.exe	9ff69cfd1ba247337859693dc4f23908.exe

pid	process
2040	9ff69cfd1ba247337859693dc4f23908.exe

pid	process
1648	9ff69cfd1ba247337859693dc4f23908.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

9ff69cfd1ba247337859693dc4f23908.exe

description	pid	process	target process
PID 1648 wrote to memory of 2040	1648	9ff69cfd1ba247337859693dc4f23908.exe	9ff69cfd1ba247337859693dc4f23908.exe
PID 1648 wrote to memory of 2040	1648	9ff69cfd1ba247337859693dc4f23908.exe	9ff69cfd1ba247337859693dc4f23908.exe
PID 1648 wrote to memory of 2040	1648	9ff69cfd1ba247337859693dc4f23908.exe	9ff69cfd1ba247337859693dc4f23908.exe
PID 1648 wrote to memory of 2040	1648	9ff69cfd1ba247337859693dc4f23908.exe	9ff69cfd1ba247337859693dc4f23908.exe
PID 1648 wrote to memory of 2040	1648	9ff69cfd1ba247337859693dc4f23908.exe	9ff69cfd1ba247337859693dc4f23908.exe

C:\Users\Admin\AppData\Local\Temp\9ff69cfd1ba247337859693dc4f23908.exe
"C:\Users\Admin\AppData\Local\Temp\9ff69cfd1ba247337859693dc4f23908.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1648

C:\Users\Admin\AppData\Local\Temp\9ff69cfd1ba247337859693dc4f23908.exe
"C:\Users\Admin\AppData\Local\Temp\9ff69cfd1ba247337859693dc4f23908.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-0-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1648-1-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2040-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2040-4-0x0000000000930000-0x0000000000C33000-memory.dmp

Filesize
3.0MB

Download