xloader | 24a6937972322f9010713e46770c092835a064a4185a7ea6444054fde57e6c10

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 20:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe
Size

423KB
MD5

f4367b0139952a0f2cf8a669484f35b9
SHA1

d5a34c1fe6fa4ae0d9430de94514b150041df431
SHA256

2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67
SHA512

330dcbd55d7fa54aec5ab99cd559d414db585bfccd5dcb9a307796d6541ce781e369423042b8d6f2f8c7059a265a78f75f42748e40aa73aa438ffa762bd80449
SSDEEP

6144:9wVQx8ayrbor77JaQOCzixo3wFnK0+pDp2WyULR5z/ug:JxPgUrAQOE02h1bTzWg

Score

10^/10

xloader 0pu8 discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

0pu8

Decoy

washyearwake.space

s-takata.com

sattadelhiborder47.xyz

watch-tbn.net

hklawns.com

schuylkillc.com

brightonbybench.xyz

treslrefinance.com

redwoodwomen.com

les4asdudekhockey.com

clarityandflow.coach

d-spor.online

1agiostratitis.com

ai-technology-online-ru.digital

eightstraps.com

qingus.com

it321.net

cryptochatr.com

swguangna.com

jax3.website

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2700-11-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

pid	Process
2856	2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2856 set thread context of 2700	2856	2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2700	2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2700	2856	2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe	30
PID 2856 wrote to memory of 2700	2856	2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe	30
PID 2856 wrote to memory of 2700	2856	2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe	30
PID 2856 wrote to memory of 2700	2856	2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe	30
PID 2856 wrote to memory of 2700	2856	2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe	30
PID 2856 wrote to memory of 2700	2856	2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe	30
PID 2856 wrote to memory of 2700	2856	2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe	30

C:\Users\Admin\AppData\Local\Temp\2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe
"C:\Users\Admin\AppData\Local\Temp\2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe
  "C:\Users\Admin\AppData\Local\Temp\2640ec73eb8aa419bbcf1819bb1062dcc7bbc8a1ec30c1a975e80e3182449f67.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nst737D.tmp\hvlovmp.dll

Filesize
4KB

MD5
326a702abb396435221880fd71450249

SHA1
62f5a8e24469859250a5630e5b9280b8472e5a56

SHA256
f936817179febc934e8fa271aac522f989e6a6b43ebf42a44588f71ecae79042

SHA512
3018fa492ecbba49350db3f93df5f20852a47dd363315704737b2abd9c70bf86cc74858572a267e7fb79f8590c064ebaa0024ac84b41fb7fb684a3c23f7da615

Download Submit
memory/2700-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2856-10-0x0000000000090000-0x0000000000190000-memory.dmp

Filesize
1024KB

Download