xloader | c01319e969a567a2494e73bfb5179f75a9dc6a0bfb7e0ac56250dc90a72e8959

Analysis

max time kernel
92s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

243d713a5124eb1bb3b1ee2e70c7a404d531da84c68bbfa5a838b092a1058a7a.exe
Size

1.1MB
MD5

f9bc884d392b1cf3476d36733d443bea
SHA1

0355cac4a25abc48cc625b2da9187e7f0d1e5574
SHA256

243d713a5124eb1bb3b1ee2e70c7a404d531da84c68bbfa5a838b092a1058a7a
SHA512

b59affcf56c37f8837ffe1009eda97ae871bed924c83526ddf139dc6ddce304f56ebc4df4dee2d01dfc09147eff1c8cef5692ce331e5ba49349e4fb9e9edaf48
SSDEEP

24576:JYXKi8Tg5e4Nkva4tZxXw4icnnmPHZYD5F3Kd8:JYXKi8Tee64tp7mhYj3Ke

Score

10^/10

xloader usur loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

usur

Decoy

purpopup.com

mrswarrenspodcast.com

blinbins.com

parahomeoffice.com

20next.com

quiala.com

newccosecurity.net

throughthehagstone.com

hnxslawfirm.com

sztoium.icu

fullembodiedwoman.com

sankara-yoga.com

foottrafficcollective.com

acruxvacations.com

jadeena.com

neurotypicalspouse.com

onlyinwallkill.com

laurenkilbane.com

thebendavonte.com

regencydevelopmentstoronto.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4748-13-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2156 set thread context of 4748	2156	243d713a5124eb1bb3b1ee2e70c7a404d531da84c68bbfa5a838b092a1058a7a.exe	96

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4748	243d713a5124eb1bb3b1ee2e70c7a404d531da84c68bbfa5a838b092a1058a7a.exe
4748	243d713a5124eb1bb3b1ee2e70c7a404d531da84c68bbfa5a838b092a1058a7a.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 4748	2156	243d713a5124eb1bb3b1ee2e70c7a404d531da84c68bbfa5a838b092a1058a7a.exe	96
PID 2156 wrote to memory of 4748	2156	243d713a5124eb1bb3b1ee2e70c7a404d531da84c68bbfa5a838b092a1058a7a.exe	96
PID 2156 wrote to memory of 4748	2156	243d713a5124eb1bb3b1ee2e70c7a404d531da84c68bbfa5a838b092a1058a7a.exe	96
PID 2156 wrote to memory of 4748	2156	243d713a5124eb1bb3b1ee2e70c7a404d531da84c68bbfa5a838b092a1058a7a.exe	96
PID 2156 wrote to memory of 4748	2156	243d713a5124eb1bb3b1ee2e70c7a404d531da84c68bbfa5a838b092a1058a7a.exe	96
PID 2156 wrote to memory of 4748	2156	243d713a5124eb1bb3b1ee2e70c7a404d531da84c68bbfa5a838b092a1058a7a.exe	96

C:\Users\Admin\AppData\Local\Temp\243d713a5124eb1bb3b1ee2e70c7a404d531da84c68bbfa5a838b092a1058a7a.exe
"C:\Users\Admin\AppData\Local\Temp\243d713a5124eb1bb3b1ee2e70c7a404d531da84c68bbfa5a838b092a1058a7a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\243d713a5124eb1bb3b1ee2e70c7a404d531da84c68bbfa5a838b092a1058a7a.exe
  "C:\Users\Admin\AppData\Local\Temp\243d713a5124eb1bb3b1ee2e70c7a404d531da84c68bbfa5a838b092a1058a7a.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-8-0x0000000005430000-0x0000000005446000-memory.dmp

Filesize
88KB

Download
memory/2156-6-0x0000000005A70000-0x0000000005A7A000-memory.dmp

Filesize
40KB

Download
memory/2156-2-0x00000000059B0000-0x0000000005A4C000-memory.dmp

Filesize
624KB

Download
memory/2156-3-0x0000000006070000-0x0000000006614000-memory.dmp

Filesize
5.6MB

Download
memory/2156-0-0x0000000000EC0000-0x0000000000FE6000-memory.dmp

Filesize
1.1MB

Download
memory/2156-5-0x0000000005DB0000-0x0000000005DC0000-memory.dmp

Filesize
64KB

Download
memory/2156-1-0x00000000751C0000-0x0000000075970000-memory.dmp

Filesize
7.7MB

Download
memory/2156-7-0x0000000005CF0000-0x0000000005D46000-memory.dmp

Filesize
344KB

Download
memory/2156-4-0x0000000005B60000-0x0000000005BF2000-memory.dmp

Filesize
584KB

Download
memory/2156-9-0x00000000751C0000-0x0000000075970000-memory.dmp

Filesize
7.7MB

Download
memory/2156-10-0x0000000005DB0000-0x0000000005DC0000-memory.dmp

Filesize
64KB

Download
memory/2156-11-0x0000000008620000-0x00000000086C2000-memory.dmp

Filesize
648KB

Download
memory/2156-12-0x00000000087C0000-0x000000000881A000-memory.dmp

Filesize
360KB

Download
memory/2156-15-0x00000000751C0000-0x0000000075970000-memory.dmp

Filesize
7.7MB

Download
memory/4748-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4748-16-0x00000000010A0000-0x00000000013EA000-memory.dmp

Filesize
3.3MB

Download