xloader | 1456b8338fa5a0d243dc211aa6969eb72cc24c90d74968d7296b93028df6a23b

Analysis

max time kernel
40s
max time network
20s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24-12-2024 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6fc8bbf9d585429d28269af4f4626388f2451f57f714797dcdaee31f0b089f9.exe
Size

713KB
MD5

add4d57c8018f168bbbc385529324a54
SHA1

16393725306391ff0a9ee034e87655f3819bab60
SHA256

e6fc8bbf9d585429d28269af4f4626388f2451f57f714797dcdaee31f0b089f9
SHA512

1021a5da690d129fb40ac8f022edf2cc4e73d13824d9db04467022c91d6d3ee39dca911f03391b1b40a00a83957e4bca7ca1d7a3faeb7a6b88bab3330c804a32
SSDEEP

12288:FcCk7Wx7POFvySOjzJG8/euv4/DWHokcqrkIGZJdthDf2LI2qM+k:FzlPOFvySOSuv4mokDrM32L6

Score

10^/10

xloader ef6c discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/3060-12-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2548 set thread context of 3060	2548	e6fc8bbf9d585429d28269af4f4626388f2451f57f714797dcdaee31f0b089f9.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e6fc8bbf9d585429d28269af4f4626388f2451f57f714797dcdaee31f0b089f9.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3060	e6fc8bbf9d585429d28269af4f4626388f2451f57f714797dcdaee31f0b089f9.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 3060	2548	e6fc8bbf9d585429d28269af4f4626388f2451f57f714797dcdaee31f0b089f9.exe	30
PID 2548 wrote to memory of 3060	2548	e6fc8bbf9d585429d28269af4f4626388f2451f57f714797dcdaee31f0b089f9.exe	30
PID 2548 wrote to memory of 3060	2548	e6fc8bbf9d585429d28269af4f4626388f2451f57f714797dcdaee31f0b089f9.exe	30
PID 2548 wrote to memory of 3060	2548	e6fc8bbf9d585429d28269af4f4626388f2451f57f714797dcdaee31f0b089f9.exe	30
PID 2548 wrote to memory of 3060	2548	e6fc8bbf9d585429d28269af4f4626388f2451f57f714797dcdaee31f0b089f9.exe	30
PID 2548 wrote to memory of 3060	2548	e6fc8bbf9d585429d28269af4f4626388f2451f57f714797dcdaee31f0b089f9.exe	30
PID 2548 wrote to memory of 3060	2548	e6fc8bbf9d585429d28269af4f4626388f2451f57f714797dcdaee31f0b089f9.exe	30

C:\Users\Admin\AppData\Local\Temp\e6fc8bbf9d585429d28269af4f4626388f2451f57f714797dcdaee31f0b089f9.exe
"C:\Users\Admin\AppData\Local\Temp\e6fc8bbf9d585429d28269af4f4626388f2451f57f714797dcdaee31f0b089f9.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Temp\e6fc8bbf9d585429d28269af4f4626388f2451f57f714797dcdaee31f0b089f9.exe
  "C:\Users\Admin\AppData\Local\Temp\e6fc8bbf9d585429d28269af4f4626388f2451f57f714797dcdaee31f0b089f9.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-6-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2548-0-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

Filesize
4KB

Download
memory/2548-2-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2548-3-0x0000000000E10000-0x0000000000EB2000-memory.dmp

Filesize
648KB

Download
memory/2548-4-0x0000000000300000-0x000000000030E000-memory.dmp

Filesize
56KB

Download
memory/2548-5-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

Filesize
4KB

Download
memory/2548-1-0x0000000000EB0000-0x0000000000F6A000-memory.dmp

Filesize
744KB

Download
memory/2548-7-0x0000000004DE0000-0x0000000004E3E000-memory.dmp

Filesize
376KB

Download
memory/2548-13-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/3060-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3060-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3060-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3060-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3060-14-0x0000000000850000-0x0000000000B53000-memory.dmp

Filesize
3.0MB

Download