xloader | 242f6abffd1b5ac336295105b07817c000c94256082b63928fb1b149b6865209

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d.exe
Size

1.0MB
MD5

2a18e326c67bc62fadf1b897e2653c47
SHA1

67b5e4920118d62f37b15c0746d691a00e457309
SHA256

e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d
SHA512

018fb7459624a6707a26471ec0b8450ced219d4b7abd5ffcfff36c60455809de393eb204a427be6a91b134bc33d4baf12e6baf707f2218e250f5b80b69285ec7
SSDEEP

24576:wAEhaozWd4qjKlwrb7ddYVvgebPkAZv5nPW3Ry2Z:wrzK82fhOVNb8AZv5nPw82Z

Score

10^/10

xloader a8si discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

a8si

Decoy

mosquitocontrolpro.com

omfgphil.com

qqkit.net

compusolutionsac.com

skynetaccess.com

helmetmoto.com

webdomoupravitel.com

thepocket-onlinelesson.xyz

stefaniehirsch.space

goalsandballs.com

xn--bro-ba-3ya.com

tomrings.com

4520oceanviewavenue.com

mamaebemorientada.com

shopwreathrails.com

restaurantestancia.com

annaquatics.info

mnarchitect.design

best-cleaner.com

jobhuizhan.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral1/memory/772-3-0x00000000002C0000-0x00000000002CC000-memory.dmp	CustAttr

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2752-15-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 772 set thread context of 2752	772	e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d.exe	31

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2752	e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 2752	772	e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d.exe	31
PID 772 wrote to memory of 2752	772	e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d.exe	31
PID 772 wrote to memory of 2752	772	e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d.exe	31
PID 772 wrote to memory of 2752	772	e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d.exe	31
PID 772 wrote to memory of 2752	772	e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d.exe	31
PID 772 wrote to memory of 2752	772	e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d.exe	31
PID 772 wrote to memory of 2752	772	e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d.exe	31

C:\Users\Admin\AppData\Local\Temp\e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d.exe
"C:\Users\Admin\AppData\Local\Temp\e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:772
- C:\Users\Admin\AppData\Local\Temp\e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d.exe
  "C:\Users\Admin\AppData\Local\Temp\e3840b075daf6dc551b27af25e1f267859424be0383df415e554c1630f47f06d.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/772-6-0x00000000051F0000-0x00000000052AA000-memory.dmp

Filesize
744KB

Download
memory/772-0-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

Filesize
4KB

Download
memory/772-2-0x0000000074B30000-0x000000007521E000-memory.dmp

Filesize
6.9MB

Download
memory/772-3-0x00000000002C0000-0x00000000002CC000-memory.dmp

Filesize
48KB

Download
memory/772-4-0x0000000074B3E000-0x0000000074B3F000-memory.dmp

Filesize
4KB

Download
memory/772-5-0x0000000074B30000-0x000000007521E000-memory.dmp

Filesize
6.9MB

Download
memory/772-1-0x0000000000FE0000-0x00000000010EE000-memory.dmp

Filesize
1.1MB

Download
memory/772-7-0x0000000004FC0000-0x0000000005032000-memory.dmp

Filesize
456KB

Download
memory/772-16-0x0000000074B30000-0x000000007521E000-memory.dmp

Filesize
6.9MB

Download
memory/2752-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2752-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2752-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2752-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2752-17-0x0000000000AC0000-0x0000000000DC3000-memory.dmp

Filesize
3.0MB

Download