xloader | 0e23e210b0a781a42bf7f5fcf1cc95b888c1230c819fe7134f04048a36706124

General

Target

ad72eed1325274987532a72ccd525d4e.exe
Size

515KB
MD5

ad72eed1325274987532a72ccd525d4e
SHA1

1ce9c2bbcae7bfb016e3ee28f61a033c70ffa561
SHA256

0e23e210b0a781a42bf7f5fcf1cc95b888c1230c819fe7134f04048a36706124
SHA512

650b8060fad21f2ee522d6068f6552fc46cab5f9752bc5f2877bd5b5f19d8b1848d075c1c13da2b2e73227a1be49c85c6df7dcbe579128a25fd25973d917cf88

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

C2

http://www.rizrvd.com/bw82/

Decoy

fundamentaliemef.com

gallerybrows.com

leadeligey.com

octoberx2.online

climaxnovels.com

gdsjgf.com

curateherstories.com

blacksailus.com

yjpps.com

gmobilet.com

fcoins.club

foreverlive2027.com

healthyfifties.com

wmarquezy.com

housebulb.com

thebabyfriendly.com

primajayaintiperkasa.com

learnplaychess.com

chrisbubser.digital

xn--avenr-wsa.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4264-14-0x000000000041CFF0-mapping.dmp	xloader
behavioral2/memory/4264-13-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

ad72eed1325274987532a72ccd525d4e.exe

description pid process target process

PID 4708 set thread context of 4264 4708 ad72eed1325274987532a72ccd525d4e.exe ad72eed1325274987532a72ccd525d4e.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ad72eed1325274987532a72ccd525d4e.exe

pid process

4264 ad72eed1325274987532a72ccd525d4e.exe
4264 ad72eed1325274987532a72ccd525d4e.exe

description	pid	process	target process
PID 4708 set thread context of 4264	4708	ad72eed1325274987532a72ccd525d4e.exe	ad72eed1325274987532a72ccd525d4e.exe

pid	process
4264	ad72eed1325274987532a72ccd525d4e.exe
4264	ad72eed1325274987532a72ccd525d4e.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ad72eed1325274987532a72ccd525d4e.exe

description	pid	process	target process
PID 4708 wrote to memory of 4264	4708	ad72eed1325274987532a72ccd525d4e.exe	ad72eed1325274987532a72ccd525d4e.exe
PID 4708 wrote to memory of 4264	4708	ad72eed1325274987532a72ccd525d4e.exe	ad72eed1325274987532a72ccd525d4e.exe
PID 4708 wrote to memory of 4264	4708	ad72eed1325274987532a72ccd525d4e.exe	ad72eed1325274987532a72ccd525d4e.exe
PID 4708 wrote to memory of 4264	4708	ad72eed1325274987532a72ccd525d4e.exe	ad72eed1325274987532a72ccd525d4e.exe
PID 4708 wrote to memory of 4264	4708	ad72eed1325274987532a72ccd525d4e.exe	ad72eed1325274987532a72ccd525d4e.exe
PID 4708 wrote to memory of 4264	4708	ad72eed1325274987532a72ccd525d4e.exe	ad72eed1325274987532a72ccd525d4e.exe

C:\Users\Admin\AppData\Local\Temp\ad72eed1325274987532a72ccd525d4e.exe
"C:\Users\Admin\AppData\Local\Temp\ad72eed1325274987532a72ccd525d4e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4708

C:\Users\Admin\AppData\Local\Temp\ad72eed1325274987532a72ccd525d4e.exe
"C:\Users\Admin\AppData\Local\Temp\ad72eed1325274987532a72ccd525d4e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4264

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4264-14-0x000000000041CFF0-mapping.dmp

Download
memory/4264-16-0x00000000014E0000-0x0000000001800000-memory.dmp

Filesize
3.1MB

Download
memory/4264-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4708-9-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/4708-7-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/4708-8-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/4708-2-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/4708-10-0x0000000004EF0000-0x0000000004EF7000-memory.dmp

Filesize
28KB

Download
memory/4708-11-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/4708-12-0x0000000005450000-0x000000000549F000-memory.dmp

Filesize
316KB

Download
memory/4708-6-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download
memory/4708-5-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/4708-3-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing