xloader | cac5a5a1cd604a792b9231fb65fe38110c631873cfa834bf4f43b9418d1ec17f

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16/02/2024, 10:10

Target
a01ccf9ea1cd42165dcf68211a819193.exe
Size 463KB
Sample240216-l7tkzagc6t
SHA256 cac5a5a1cd604a792b9231fb65fe38110c631873cfa834bf4f43b9418d1ec17f
MD5 a01ccf9ea1cd42165dcf68211a819193
SHA1 f6bcccfe7a15aa6ec76aa60e27e84f81ce966019
SHA512 edfe36fbd1238d7249d57efa8922369801144bf64908b1b9607ab387003f40363bad164b00965490b9cb4c0e1fc30a00fcf95916e5afa28b60aa6f5c3e6225fd
SSDEEP 12288:IsZnGIIyuA5qe7RZlSzE7hvaVciuK8Ipuu3AnbSUsFkJ:IsZnGUuvy23LouCSUfJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Version

Campaign

Decoy

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4344-3-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5100 set thread context of 4344	5100	a01ccf9ea1cd42165dcf68211a819193.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4344	a01ccf9ea1cd42165dcf68211a819193.exe
4344	a01ccf9ea1cd42165dcf68211a819193.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
5100	a01ccf9ea1cd42165dcf68211a819193.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 4344	5100	a01ccf9ea1cd42165dcf68211a819193.exe	84
PID 5100 wrote to memory of 4344	5100	a01ccf9ea1cd42165dcf68211a819193.exe	84
PID 5100 wrote to memory of 4344	5100	a01ccf9ea1cd42165dcf68211a819193.exe	84
PID 5100 wrote to memory of 4344	5100	a01ccf9ea1cd42165dcf68211a819193.exe	84

C:\Users\Admin\AppData\Local\Temp\a01ccf9ea1cd42165dcf68211a819193.exe
"C:\Users\Admin\AppData\Local\Temp\a01ccf9ea1cd42165dcf68211a819193.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\a01ccf9ea1cd42165dcf68211a819193.exe
  "C:\Users\Admin\AppData\Local\Temp\a01ccf9ea1cd42165dcf68211a819193.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344

memory/4344-3-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4344-4-0x00000000019A0000-0x0000000001CEA000-memory.dmp

Download

memory/5100-1-0x0000000000840000-0x0000000000940000-memory.dmp

Download

memory/5100-2-0x0000000000CD0000-0x0000000000CD2000-memory.dmp

Download