xloader | b8fecafb0ea8ed59d3c66ea34f14f25f1354589750fc854ff78c11e10cc3421b

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Transfer Swift Copy.exe
Size

528KB
MD5

0d5bfa60273cf3871c7596b7aa2fc447
SHA1

451461604085634e62758f142fbca0bdbf12a044
SHA256

e51b63aacca71c639c6f3b12a6b0eede821c54567125b52a21a0a24ec540d04a
SHA512

33afea5b2367b0f4a0f222d14d4fe531c8b076ff1c253897b4e69f9a2956637573284cb7433d75e09d6aeb6f1891a3b962672cd7be561f25e0649def528276a2
SSDEEP

12288:ZhQVh9a17gNm5YnXDdx2OjKhNHySntntjEyjIOm+mmmTIhfCGONcR9Ok:ZhQVh9FDdx2GKzSSt9ZSsmToik

Score

10^/10

xloader u8aa loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

u8aa

Decoy

quantexchanges.com

hizliarac.com

dropsdementanovohamburgo.com

tcinsurancegroup.net

byobvendors.com

arteasba.com

azrealtorsmastermind.com

voiceof5aabtv.com

zoom-bloopers.com

jxsenmei.com

interia-poczta.email

coolgiftbaskets.net

magetu.info

weedliberal.com

drsergiocastilloangiologo.com

starinsiderau.com

weightneutralmetflex.com

youxiandian.com

liberation.media

ferrari-news.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2976-2-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

Transfer Swift Copy.exe

description	pid	Process	procid_target
PID 2952 set thread context of 2976	2952	Transfer Swift Copy.exe	28

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1924	2976	WerFault.exe	28

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Transfer Swift Copy.exe

pid	Process
2952	Transfer Swift Copy.exe
2952	Transfer Swift Copy.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Transfer Swift Copy.exeTransfer Swift Copy.exe

description	pid	Process	procid_target
PID 2952 wrote to memory of 2976	2952	Transfer Swift Copy.exe	28
PID 2952 wrote to memory of 2976	2952	Transfer Swift Copy.exe	28
PID 2952 wrote to memory of 2976	2952	Transfer Swift Copy.exe	28
PID 2952 wrote to memory of 2976	2952	Transfer Swift Copy.exe	28
PID 2952 wrote to memory of 2976	2952	Transfer Swift Copy.exe	28
PID 2976 wrote to memory of 1924	2976	Transfer Swift Copy.exe	29
PID 2976 wrote to memory of 1924	2976	Transfer Swift Copy.exe	29
PID 2976 wrote to memory of 1924	2976	Transfer Swift Copy.exe	29
PID 2976 wrote to memory of 1924	2976	Transfer Swift Copy.exe	29

C:\Users\Admin\AppData\Local\Temp\Transfer Swift Copy.exe
"C:\Users\Admin\AppData\Local\Temp\Transfer Swift Copy.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Users\Admin\AppData\Local\Temp\Transfer Swift Copy.exe
  "C:\Users\Admin\AppData\Local\Temp\Transfer Swift Copy.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 36
    3⤵
    - Program crash
    PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2952-0-0x0000000000DE0000-0x0000000000E34000-memory.dmp

Filesize
336KB

Download
memory/2952-1-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/2952-4-0x0000000000DE0000-0x0000000000E34000-memory.dmp

Filesize
336KB

Download
memory/2976-2-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download