xloader | 958db47a4769c917239ff91dc25f4a09fd05ac2dd92c9b2eb11bfbd19832b550

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

958db47a4769c917239ff91dc25f4a09fd05ac2dd92c9b2eb11bfbd19832b550.exe
Size

461KB
MD5

b6b72695524b77e6a03efd940c89175f
SHA1

86a3ec13c5d907ffb475404712fdc7b95386c48f
SHA256

958db47a4769c917239ff91dc25f4a09fd05ac2dd92c9b2eb11bfbd19832b550
SHA512

3a0b61da34c0e77109b0cee9b331258bece42451017d413a62bff330494155256e88fdb1e2346af0e42e73704c6d3341eacd052a5b45de0ff0beae5722b11755
SSDEEP

6144:UfHlm0I6Uqd2GhNoWnti/tanHwGslCmeMPSeKsyLGjloc5GWBqeq8Q2z:UfFZUi2iN9NH3wR6Ajld5G0qf8h

Score

10^/10

xloader euzn discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euzn

Decoy

235296tyc.com

gold12guide.art

baibuaherb.com

weberwines.tax

chezvitoria.com

aidenb.tech

pitchdeckservice.com

surgeryforfdf.xyz

workunvaccinated.com

hrtaro.com

yourotcs.com

sonimultispecialityclinic.com

consultantadvisors.com

pentesting-consulting.com

dantechs.digital

longshifa.online

taweilai.net

imyusuke.com

cashndashfinancial.com

fasiglimt.quest

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2992-11-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3012 set thread context of 2992	3012	958db47a4769c917239ff91dc25f4a09fd05ac2dd92c9b2eb11bfbd19832b550.exe	31

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	958db47a4769c917239ff91dc25f4a09fd05ac2dd92c9b2eb11bfbd19832b550.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2992	958db47a4769c917239ff91dc25f4a09fd05ac2dd92c9b2eb11bfbd19832b550.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2992	3012	958db47a4769c917239ff91dc25f4a09fd05ac2dd92c9b2eb11bfbd19832b550.exe	31
PID 3012 wrote to memory of 2992	3012	958db47a4769c917239ff91dc25f4a09fd05ac2dd92c9b2eb11bfbd19832b550.exe	31
PID 3012 wrote to memory of 2992	3012	958db47a4769c917239ff91dc25f4a09fd05ac2dd92c9b2eb11bfbd19832b550.exe	31
PID 3012 wrote to memory of 2992	3012	958db47a4769c917239ff91dc25f4a09fd05ac2dd92c9b2eb11bfbd19832b550.exe	31
PID 3012 wrote to memory of 2992	3012	958db47a4769c917239ff91dc25f4a09fd05ac2dd92c9b2eb11bfbd19832b550.exe	31
PID 3012 wrote to memory of 2992	3012	958db47a4769c917239ff91dc25f4a09fd05ac2dd92c9b2eb11bfbd19832b550.exe	31
PID 3012 wrote to memory of 2992	3012	958db47a4769c917239ff91dc25f4a09fd05ac2dd92c9b2eb11bfbd19832b550.exe	31

C:\Users\Admin\AppData\Local\Temp\958db47a4769c917239ff91dc25f4a09fd05ac2dd92c9b2eb11bfbd19832b550.exe
"C:\Users\Admin\AppData\Local\Temp\958db47a4769c917239ff91dc25f4a09fd05ac2dd92c9b2eb11bfbd19832b550.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\958db47a4769c917239ff91dc25f4a09fd05ac2dd92c9b2eb11bfbd19832b550.exe
  "C:\Users\Admin\AppData\Local\Temp\958db47a4769c917239ff91dc25f4a09fd05ac2dd92c9b2eb11bfbd19832b550.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2992-6-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2992-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2992-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2992-7-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2992-13-0x0000000000A20000-0x0000000000D23000-memory.dmp

Filesize
3.0MB

Download
memory/3012-0-0x0000000073EDE000-0x0000000073EDF000-memory.dmp

Filesize
4KB

Download
memory/3012-1-0x0000000000310000-0x000000000038A000-memory.dmp

Filesize
488KB

Download
memory/3012-2-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download
memory/3012-3-0x00000000006F0000-0x00000000006FE000-memory.dmp

Filesize
56KB

Download
memory/3012-4-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download
memory/3012-5-0x0000000004630000-0x0000000004682000-memory.dmp

Filesize
328KB

Download
memory/3012-12-0x0000000073ED0000-0x00000000745BE000-memory.dmp

Filesize
6.9MB

Download