xloader | b8fecafb0ea8ed59d3c66ea34f14f25f1354589750fc854ff78c11e10cc3421b

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Transfer Swift Copy.exe
Size

528KB
MD5

0d5bfa60273cf3871c7596b7aa2fc447
SHA1

451461604085634e62758f142fbca0bdbf12a044
SHA256

e51b63aacca71c639c6f3b12a6b0eede821c54567125b52a21a0a24ec540d04a
SHA512

33afea5b2367b0f4a0f222d14d4fe531c8b076ff1c253897b4e69f9a2956637573284cb7433d75e09d6aeb6f1891a3b962672cd7be561f25e0649def528276a2
SSDEEP

12288:ZhQVh9a17gNm5YnXDdx2OjKhNHySntntjEyjIOm+mmmTIhfCGONcR9Ok:ZhQVh9FDdx2GKzSSt9ZSsmToik

Score

10^/10

xloader u8aa loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

u8aa

Decoy

quantexchanges.com

hizliarac.com

dropsdementanovohamburgo.com

tcinsurancegroup.net

byobvendors.com

arteasba.com

azrealtorsmastermind.com

voiceof5aabtv.com

zoom-bloopers.com

jxsenmei.com

interia-poczta.email

coolgiftbaskets.net

magetu.info

weedliberal.com

drsergiocastilloangiologo.com

starinsiderau.com

weightneutralmetflex.com

youxiandian.com

liberation.media

ferrari-news.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader payload 1 IoCs
rat

Processes:

resource yara_rule

behavioral1/memory/2976-2-0x0000000000080000-0x00000000000A9000-memory.dmp xloader
Suspicious use of SetThreadContext 1 IoCs

Processes:

Transfer Swift Copy.exe

description pid process target process

PID 2952 set thread context of 2976 2952 Transfer Swift Copy.exe Transfer Swift Copy.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1924 2976 WerFault.exe Transfer Swift Copy.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Transfer Swift Copy.exe

pid process

2952 Transfer Swift Copy.exe
2952 Transfer Swift Copy.exe

resource	yara_rule
behavioral1/memory/2976-2-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

description	pid	process	target process
PID 2952 set thread context of 2976	2952	Transfer Swift Copy.exe	Transfer Swift Copy.exe

pid	pid_target	process	target process
1924	2976	WerFault.exe	Transfer Swift Copy.exe

pid	process
2952	Transfer Swift Copy.exe
2952	Transfer Swift Copy.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Transfer Swift Copy.exeTransfer Swift Copy.exe

description	pid	process	target process
PID 2952 wrote to memory of 2976	2952	Transfer Swift Copy.exe	Transfer Swift Copy.exe
PID 2952 wrote to memory of 2976	2952	Transfer Swift Copy.exe	Transfer Swift Copy.exe
PID 2952 wrote to memory of 2976	2952	Transfer Swift Copy.exe	Transfer Swift Copy.exe
PID 2952 wrote to memory of 2976	2952	Transfer Swift Copy.exe	Transfer Swift Copy.exe
PID 2952 wrote to memory of 2976	2952	Transfer Swift Copy.exe	Transfer Swift Copy.exe
PID 2976 wrote to memory of 1924	2976	Transfer Swift Copy.exe	WerFault.exe
PID 2976 wrote to memory of 1924	2976	Transfer Swift Copy.exe	WerFault.exe
PID 2976 wrote to memory of 1924	2976	Transfer Swift Copy.exe	WerFault.exe
PID 2976 wrote to memory of 1924	2976	Transfer Swift Copy.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Transfer Swift Copy.exe
"C:\Users\Admin\AppData\Local\Temp\Transfer Swift Copy.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2952

C:\Users\Admin\AppData\Local\Temp\Transfer Swift Copy.exe
"C:\Users\Admin\AppData\Local\Temp\Transfer Swift Copy.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 36
3⤵
- Program crash
PID:1924

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2952-0-0x0000000000DE0000-0x0000000000E34000-memory.dmp

Filesize
336KB

Download
memory/2952-1-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/2952-4-0x0000000000DE0000-0x0000000000E34000-memory.dmp

Filesize
336KB

Download
memory/2976-2-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download