xloader | 3e4d822608eabbd09ec42b37c1e935582e32e4f75a2d1248e261814faead9d4b

Analysis

max time kernel
102s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2869e0c3e746c3baa787fb20464d3b4b286591d96f1ea89b8d852bcae32f4ef0.exe
Size

495KB
MD5

1d4fd5f9ce67b9701527fe44c5c01328
SHA1

cd0b4fb2f1ba6d54310cd4cad70e375c7da3e5ef
SHA256

2869e0c3e746c3baa787fb20464d3b4b286591d96f1ea89b8d852bcae32f4ef0
SHA512

e43d10db454ab5d025f5043812c0ad116102b09230bb1b1e72760d000f9de41b172e1d6bccc05b5504fcf67ec0a2620275f85078f4adc3d7b2ec433ac498b0f5
SSDEEP

12288:3gfm1GNmrNm2r5t8v+vtrqt6QuQnKTrMqTUcvJbNm:mgHkSt0+vtBTrpUci

Score

10^/10

xloader mwfc discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mwfc

Decoy

a-great-intl-voip-phones.zone

police-trust-security.com

415391.com

coi-sl.com

liming-steel.com

criticalracetheoryexplained.com

pintoent.com

columbusrx.com

clarktribe.net

texasforblanchard.com

musical.voyage

priyamblogs.com

employbridge.works

americanchessmaster.com

australiaaddictioncenters.com

drkell-yann.xyz

barryisdaner.com

frankkystein.art

aromatoto7.com

alsuwal.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/5088-13-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1848 set thread context of 5088	1848	2869e0c3e746c3baa787fb20464d3b4b286591d96f1ea89b8d852bcae32f4ef0.exe	99

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2869e0c3e746c3baa787fb20464d3b4b286591d96f1ea89b8d852bcae32f4ef0.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5088	2869e0c3e746c3baa787fb20464d3b4b286591d96f1ea89b8d852bcae32f4ef0.exe
5088	2869e0c3e746c3baa787fb20464d3b4b286591d96f1ea89b8d852bcae32f4ef0.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 5088	1848	2869e0c3e746c3baa787fb20464d3b4b286591d96f1ea89b8d852bcae32f4ef0.exe	99
PID 1848 wrote to memory of 5088	1848	2869e0c3e746c3baa787fb20464d3b4b286591d96f1ea89b8d852bcae32f4ef0.exe	99
PID 1848 wrote to memory of 5088	1848	2869e0c3e746c3baa787fb20464d3b4b286591d96f1ea89b8d852bcae32f4ef0.exe	99
PID 1848 wrote to memory of 5088	1848	2869e0c3e746c3baa787fb20464d3b4b286591d96f1ea89b8d852bcae32f4ef0.exe	99
PID 1848 wrote to memory of 5088	1848	2869e0c3e746c3baa787fb20464d3b4b286591d96f1ea89b8d852bcae32f4ef0.exe	99
PID 1848 wrote to memory of 5088	1848	2869e0c3e746c3baa787fb20464d3b4b286591d96f1ea89b8d852bcae32f4ef0.exe	99

C:\Users\Admin\AppData\Local\Temp\2869e0c3e746c3baa787fb20464d3b4b286591d96f1ea89b8d852bcae32f4ef0.exe
"C:\Users\Admin\AppData\Local\Temp\2869e0c3e746c3baa787fb20464d3b4b286591d96f1ea89b8d852bcae32f4ef0.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\2869e0c3e746c3baa787fb20464d3b4b286591d96f1ea89b8d852bcae32f4ef0.exe
  "C:\Users\Admin\AppData\Local\Temp\2869e0c3e746c3baa787fb20464d3b4b286591d96f1ea89b8d852bcae32f4ef0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1848-8-0x000000007486E000-0x000000007486F000-memory.dmp

Filesize
4KB

Download
memory/1848-6-0x0000000005370000-0x0000000005384000-memory.dmp

Filesize
80KB

Download
memory/1848-2-0x0000000005720000-0x0000000005CC4000-memory.dmp

Filesize
5.6MB

Download
memory/1848-3-0x0000000005210000-0x00000000052A2000-memory.dmp

Filesize
584KB

Download
memory/1848-0-0x000000007486E000-0x000000007486F000-memory.dmp

Filesize
4KB

Download
memory/1848-5-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/1848-1-0x0000000000770000-0x00000000007F2000-memory.dmp

Filesize
520KB

Download
memory/1848-7-0x00000000068E0000-0x000000000697C000-memory.dmp

Filesize
624KB

Download
memory/1848-4-0x00000000052B0000-0x00000000052BA000-memory.dmp

Filesize
40KB

Download
memory/1848-9-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/1848-10-0x0000000007D80000-0x0000000007DF4000-memory.dmp

Filesize
464KB

Download
memory/1848-11-0x0000000007E60000-0x0000000007EC6000-memory.dmp

Filesize
408KB

Download
memory/1848-12-0x0000000007E10000-0x0000000007E40000-memory.dmp

Filesize
192KB

Download
memory/1848-15-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/5088-13-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5088-16-0x00000000019F0000-0x0000000001D3A000-memory.dmp

Filesize
3.3MB

Download