xloader | 88f306ca63bb704de8cdcdf219be2304906d5fe8b80b569c640b89a73c7608a6

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

732d6097dbd7e3dea8d83a0261e0d834430a56119b278e3fb38b15c27147bf7f.exe
Size

585KB
MD5

5496ecc8611af1fa119a753fce53cb18
SHA1

ad3e75f3f8ce863ea9bd3f5cac9598a7b8a27e82
SHA256

732d6097dbd7e3dea8d83a0261e0d834430a56119b278e3fb38b15c27147bf7f
SHA512

e1fdffc43c0d903a5aa8c36410d78fadeb24d3baefd8d60fc9dd36aca78d0ada95b2c03ee4b340753ace3b2e925ab3525a75f03b3882bee3683c52ad8a88645e
SSDEEP

12288:V1jsAJrnQv6br2GCOovnBvA2J124cnKY1hRg4HRPk6AcHrBZzHr63QC28OB:V1jsU8v6o7vnB42ePbR

Score

10^/10

xloader gm9w discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

gm9w

Decoy

steffiemor.com

qe2rvstorage.com

louisteak.com

top-dex2.com

fafeiya.com

saffure.com

1upshopandstuff.com

wemove66.com

deckswap.info

joinjifu.com

joboval.com

stilldeliciousvegan.com

intercunt.com

espaciosterapeutas.com

doglai.com

situationslayer.com

adbreaks.net

cdjy666.com

ap70mm.com

gwh525.xyz

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3928-13-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4744 set thread context of 3928	4744	732d6097dbd7e3dea8d83a0261e0d834430a56119b278e3fb38b15c27147bf7f.exe	98

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	732d6097dbd7e3dea8d83a0261e0d834430a56119b278e3fb38b15c27147bf7f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3928	732d6097dbd7e3dea8d83a0261e0d834430a56119b278e3fb38b15c27147bf7f.exe
3928	732d6097dbd7e3dea8d83a0261e0d834430a56119b278e3fb38b15c27147bf7f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 3928	4744	732d6097dbd7e3dea8d83a0261e0d834430a56119b278e3fb38b15c27147bf7f.exe	98
PID 4744 wrote to memory of 3928	4744	732d6097dbd7e3dea8d83a0261e0d834430a56119b278e3fb38b15c27147bf7f.exe	98
PID 4744 wrote to memory of 3928	4744	732d6097dbd7e3dea8d83a0261e0d834430a56119b278e3fb38b15c27147bf7f.exe	98
PID 4744 wrote to memory of 3928	4744	732d6097dbd7e3dea8d83a0261e0d834430a56119b278e3fb38b15c27147bf7f.exe	98
PID 4744 wrote to memory of 3928	4744	732d6097dbd7e3dea8d83a0261e0d834430a56119b278e3fb38b15c27147bf7f.exe	98
PID 4744 wrote to memory of 3928	4744	732d6097dbd7e3dea8d83a0261e0d834430a56119b278e3fb38b15c27147bf7f.exe	98

C:\Users\Admin\AppData\Local\Temp\732d6097dbd7e3dea8d83a0261e0d834430a56119b278e3fb38b15c27147bf7f.exe
"C:\Users\Admin\AppData\Local\Temp\732d6097dbd7e3dea8d83a0261e0d834430a56119b278e3fb38b15c27147bf7f.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Users\Admin\AppData\Local\Temp\732d6097dbd7e3dea8d83a0261e0d834430a56119b278e3fb38b15c27147bf7f.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3928-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3928-16-0x00000000018E0000-0x0000000001C2A000-memory.dmp

Filesize
3.3MB

Download
memory/4744-8-0x0000000005C30000-0x0000000005CCC000-memory.dmp

Filesize
624KB

Download
memory/4744-9-0x000000007441E000-0x000000007441F000-memory.dmp

Filesize
4KB

Download
memory/4744-4-0x0000000004FB0000-0x0000000005042000-memory.dmp

Filesize
584KB

Download
memory/4744-5-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-6-0x0000000004DD0000-0x0000000004DDA000-memory.dmp

Filesize
40KB

Download
memory/4744-7-0x0000000005140000-0x0000000005148000-memory.dmp

Filesize
32KB

Download
memory/4744-0-0x000000007441E000-0x000000007441F000-memory.dmp

Filesize
4KB

Download
memory/4744-3-0x0000000009840000-0x0000000009DE4000-memory.dmp

Filesize
5.6MB

Download
memory/4744-10-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-11-0x0000000006220000-0x00000000062A2000-memory.dmp

Filesize
520KB

Download
memory/4744-12-0x00000000051F0000-0x0000000005220000-memory.dmp

Filesize
192KB

Download
memory/4744-2-0x0000000004D40000-0x0000000004D9C000-memory.dmp

Filesize
368KB

Download
memory/4744-15-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-1-0x0000000000320000-0x00000000003B8000-memory.dmp

Filesize
608KB

Download