xloader | 87c2a597ddaca65031edb76462391be4212a5d789ab72cf0900e82da19ecf171

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe
Size

222KB
MD5

0235e629abad14322f70eadc59394bba
SHA1

6fa7ccf3bf7bd29e61f2a43a6ce453520a0c65bd
SHA256

5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183
SHA512

dbb1b0bb8bcd0d87bc2d122b4d90e522fe26fc9901ec564e5a03793be220efce812fab868011a8ac67d7e2172fa8bcfbdae59bff6b7f1b1a3b53f3b958b9ed9a
SSDEEP

6144:qNVs7YrLmcv5r3177kM4QoqmQAMMMiVJyx4c6:qNGYrHtZToRQAGY5c6

Score

10^/10

xloader vc6e discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

vc6e

Decoy

123lejeu.com

services-ti.com

iseekwithin.com

linkdbs.com

bibproductions.com

chaybo247.com

bondiblond.com

amandawilsonfamilylawyers.com

kbihualhamdaniyah.com

littletykesonline.com

circleofrepair.com

kingcartermusic.com

axqal2.com

dscfpro.xyz

cooltoysshop.com

enzocatering.com

skertyl.club

precommgateway.com

maddie-blake.com

malvinasargentina.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2780-2-0x0000000000080000-0x00000000000A8000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3012 set thread context of 2780	3012	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe	31

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2692	2780	WerFault.exe	31
2736	3012	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3012	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe
3012	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2780	3012	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe	31
PID 3012 wrote to memory of 2780	3012	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe	31
PID 3012 wrote to memory of 2780	3012	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe	31
PID 3012 wrote to memory of 2780	3012	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe	31
PID 3012 wrote to memory of 2780	3012	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe	31
PID 3012 wrote to memory of 2736	3012	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe	32
PID 3012 wrote to memory of 2736	3012	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe	32
PID 3012 wrote to memory of 2736	3012	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe	32
PID 3012 wrote to memory of 2736	3012	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe	32
PID 2780 wrote to memory of 2692	2780	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe	33
PID 2780 wrote to memory of 2692	2780	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe	33
PID 2780 wrote to memory of 2692	2780	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe	33
PID 2780 wrote to memory of 2692	2780	5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe	33

C:\Users\Admin\AppData\Local\Temp\5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe
"C:\Users\Admin\AppData\Local\Temp\5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe
  "C:\Users\Admin\AppData\Local\Temp\5aa2c01a644cd991b9cc0056f03a0a5462ea4ce6f241d1ad78f9e0b6e042c183.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 36
    3⤵
    - Program crash
    PID:2692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 112
  2⤵
  - Program crash
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2780-2-0x0000000000080000-0x00000000000A8000-memory.dmp

Filesize
160KB

Download
memory/3012-1-0x0000000000AB0000-0x0000000000AB6000-memory.dmp

Filesize
24KB

Download
memory/3012-0-0x0000000000AB3000-0x0000000000AB4000-memory.dmp

Filesize
4KB

Download