xloader | 4ffef6d996e41a7cb43bb1c56e139cf70762bd9b3ff7f5e3fa5f0649d0cd740c

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d2e62731127aba56d1cf091bdc923b8c0dfb6594fdbfbda160548fea9f64dfc.exe
Size

990KB
MD5

f6fb2f464d46e2f9a458e7bad7623c1e
SHA1

e53c7b7c302125f21b57ec935eba418b171a524a
SHA256

6d2e62731127aba56d1cf091bdc923b8c0dfb6594fdbfbda160548fea9f64dfc
SHA512

cd83198844109650a32bb92adc476a37e8f9c250eef3b484624ce6db52513460fa75539003bf0a9c2d3db932331aa3dca56d99b19d752e37f428a2492fb247cb
SSDEEP

24576:b9Ql9Zo4ir7ntRjygTPTstY2ukMUw+aERZjLsKXL9Cd2dnS:b9OZo4wlTTsNMUz3V74OS

Score

10^/10

xloader qbkr discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

qbkr

Decoy

myestiebesties.com

woodwormapothecary.com

titleholdingsllc.com

corpcepa.com

kudjujuudz.xyz

palaciomonsalud.com

jombida.com

appcast-72.com

1ane337.com

azdrainwork.com

cicinstalaciones.com

absolutenuisance.com

hovereb.com

asiapartnerspoint.com

infinite-waves.com

shafara.com

champpoint.com

luxuryhomesandwellness.com

youugou.com

templetongreenfinch.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2928-12-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1064 set thread context of 2928	1064	6d2e62731127aba56d1cf091bdc923b8c0dfb6594fdbfbda160548fea9f64dfc.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6d2e62731127aba56d1cf091bdc923b8c0dfb6594fdbfbda160548fea9f64dfc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2928	6d2e62731127aba56d1cf091bdc923b8c0dfb6594fdbfbda160548fea9f64dfc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 2928	1064	6d2e62731127aba56d1cf091bdc923b8c0dfb6594fdbfbda160548fea9f64dfc.exe	30
PID 1064 wrote to memory of 2928	1064	6d2e62731127aba56d1cf091bdc923b8c0dfb6594fdbfbda160548fea9f64dfc.exe	30
PID 1064 wrote to memory of 2928	1064	6d2e62731127aba56d1cf091bdc923b8c0dfb6594fdbfbda160548fea9f64dfc.exe	30
PID 1064 wrote to memory of 2928	1064	6d2e62731127aba56d1cf091bdc923b8c0dfb6594fdbfbda160548fea9f64dfc.exe	30
PID 1064 wrote to memory of 2928	1064	6d2e62731127aba56d1cf091bdc923b8c0dfb6594fdbfbda160548fea9f64dfc.exe	30
PID 1064 wrote to memory of 2928	1064	6d2e62731127aba56d1cf091bdc923b8c0dfb6594fdbfbda160548fea9f64dfc.exe	30
PID 1064 wrote to memory of 2928	1064	6d2e62731127aba56d1cf091bdc923b8c0dfb6594fdbfbda160548fea9f64dfc.exe	30

C:\Users\Admin\AppData\Local\Temp\6d2e62731127aba56d1cf091bdc923b8c0dfb6594fdbfbda160548fea9f64dfc.exe
"C:\Users\Admin\AppData\Local\Temp\6d2e62731127aba56d1cf091bdc923b8c0dfb6594fdbfbda160548fea9f64dfc.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Users\Admin\AppData\Local\Temp\6d2e62731127aba56d1cf091bdc923b8c0dfb6594fdbfbda160548fea9f64dfc.exe
  "C:\Users\Admin\AppData\Local\Temp\6d2e62731127aba56d1cf091bdc923b8c0dfb6594fdbfbda160548fea9f64dfc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1064-6-0x0000000005680000-0x0000000005778000-memory.dmp

Filesize
992KB

Download
memory/1064-0-0x0000000073D1E000-0x0000000073D1F000-memory.dmp

Filesize
4KB

Download
memory/1064-2-0x0000000073D10000-0x00000000743FE000-memory.dmp

Filesize
6.9MB

Download
memory/1064-3-0x0000000000380000-0x0000000000398000-memory.dmp

Filesize
96KB

Download
memory/1064-4-0x0000000073D1E000-0x0000000073D1F000-memory.dmp

Filesize
4KB

Download
memory/1064-5-0x0000000073D10000-0x00000000743FE000-memory.dmp

Filesize
6.9MB

Download
memory/1064-1-0x0000000000F90000-0x000000000108E000-memory.dmp

Filesize
1016KB

Download
memory/1064-7-0x0000000000BD0000-0x0000000000C00000-memory.dmp

Filesize
192KB

Download
memory/1064-13-0x0000000073D10000-0x00000000743FE000-memory.dmp

Filesize
6.9MB

Download
memory/2928-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2928-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2928-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2928-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2928-14-0x0000000000A20000-0x0000000000D23000-memory.dmp

Filesize
3.0MB

Download