xloader | 2e9e849287f292db9064f54e6888184007170ca99e0b098f3d5a2c725d22fb25

Analysis

max time kernel
50s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3bed8547e488c397699d515cd97c222b482c302f4ba17a70980db6f0788dc2fe.exe
Size

516KB
MD5

661809856945e7e1f90978e165e08fed
SHA1

58bafd5fee279f6e7f2c72971b53bd16f8333693
SHA256

3bed8547e488c397699d515cd97c222b482c302f4ba17a70980db6f0788dc2fe
SHA512

0fa6ebf4f1ac67b266ffc5fce812f825c21302d15c1fa886a9a7cc6d225e0dec41482f427c05b59ca3a880ececfd999fe8853f9ad5645e4b1c6c424ffc218549
SSDEEP

12288:zMJSBpWgQ494NOg0P12c5odVAVibMFFOpuP4rjMp4dLN314qXZ:zDBUgn94NOQ8odVKibJp0LohFPZ

Score

10^/10

xloader riho discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

riho

Decoy

surfcitydawg.com

pwuq9t.com

prefectfxtrader.com

369xy.com

bjhygj888.com

cabinetfuid.com

houstondynamics.net

bertiebots.com

taboohospitality.com

fearlessthread.com

loropiana-store.online

growthventuresinc.net

artairazur.xyz

tvframesdisply.com

flammifer.biz

gtnetpro.com

b3sportaintment.com

housing-staff.net

superdelicioso.com

14mpt.xyz

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2924-14-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1276 set thread context of 2924	1276	3bed8547e488c397699d515cd97c222b482c302f4ba17a70980db6f0788dc2fe.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3bed8547e488c397699d515cd97c222b482c302f4ba17a70980db6f0788dc2fe.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2924	3bed8547e488c397699d515cd97c222b482c302f4ba17a70980db6f0788dc2fe.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2924	1276	3bed8547e488c397699d515cd97c222b482c302f4ba17a70980db6f0788dc2fe.exe	29
PID 1276 wrote to memory of 2924	1276	3bed8547e488c397699d515cd97c222b482c302f4ba17a70980db6f0788dc2fe.exe	29
PID 1276 wrote to memory of 2924	1276	3bed8547e488c397699d515cd97c222b482c302f4ba17a70980db6f0788dc2fe.exe	29
PID 1276 wrote to memory of 2924	1276	3bed8547e488c397699d515cd97c222b482c302f4ba17a70980db6f0788dc2fe.exe	29
PID 1276 wrote to memory of 2924	1276	3bed8547e488c397699d515cd97c222b482c302f4ba17a70980db6f0788dc2fe.exe	29
PID 1276 wrote to memory of 2924	1276	3bed8547e488c397699d515cd97c222b482c302f4ba17a70980db6f0788dc2fe.exe	29
PID 1276 wrote to memory of 2924	1276	3bed8547e488c397699d515cd97c222b482c302f4ba17a70980db6f0788dc2fe.exe	29

C:\Users\Admin\AppData\Local\Temp\3bed8547e488c397699d515cd97c222b482c302f4ba17a70980db6f0788dc2fe.exe
"C:\Users\Admin\AppData\Local\Temp\3bed8547e488c397699d515cd97c222b482c302f4ba17a70980db6f0788dc2fe.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\Temp\3bed8547e488c397699d515cd97c222b482c302f4ba17a70980db6f0788dc2fe.exe
  "C:\Users\Admin\AppData\Local\Temp\3bed8547e488c397699d515cd97c222b482c302f4ba17a70980db6f0788dc2fe.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-6-0x0000000004C60000-0x0000000004CD6000-memory.dmp

Filesize
472KB

Download
memory/1276-1-0x00000000008A0000-0x0000000000928000-memory.dmp

Filesize
544KB

Download
memory/1276-2-0x00000000749F0000-0x00000000750DE000-memory.dmp

Filesize
6.9MB

Download
memory/1276-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1276-4-0x00000000749FE000-0x00000000749FF000-memory.dmp

Filesize
4KB

Download
memory/1276-5-0x00000000749F0000-0x00000000750DE000-memory.dmp

Filesize
6.9MB

Download
memory/1276-0-0x00000000749FE000-0x00000000749FF000-memory.dmp

Filesize
4KB

Download
memory/1276-15-0x00000000749F0000-0x00000000750DE000-memory.dmp

Filesize
6.9MB

Download
memory/2924-7-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2924-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2924-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2924-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2924-16-0x0000000000AC0000-0x0000000000DC3000-memory.dmp

Filesize
3.0MB

Download