xloader | 414d26c286eeeda12cc3705aa3ed2ae06e901dc09795434e6abe4389f31c1e8e

General

Target

RFQ_R4100131210.pdf.exe
Size

624KB
MD5

c27bd99ca5f928a3bec7a716bd27d289
SHA1

f6ac29d30ec60cd1429bc2e31c85c8eda0bc871e
SHA256

414d26c286eeeda12cc3705aa3ed2ae06e901dc09795434e6abe4389f31c1e8e
SHA512

6cddff9fe566341de45813809e3435225fbdd75ecc73adfd630e832cb55444841a5c7bb9ec0c401d7f12eaa658032479405811bb2b7389527b14e6330327af7a

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.huamxvcyq.icu/aepn/

Decoy

noesos.com

partsus.xyz

manageordercentersupp.com

wickedwallart.com

hike4cash.com

theviragocircle.com

followthesharks.com

paradisevalleywines.com

unmetrolimpio.com

eurocarsnj.com

alvaroeliseo.com

bfc8.xyz

oldcourts.com

bkpef.info

mammately.com

agentcharles.com

wwwmichiganbulb.com

pensolid.info

hibiscushealthcare.com

mwanakbk.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/840-68-0x000000000041D070-mapping.dmp	xloader
behavioral1/memory/840-67-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/916-75-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

Processes:

RFQ_R4100131210.pdf.exeRegSvcs.exewlanext.exe

description	pid	process	target process
PID 1848 set thread context of 840	1848	RFQ_R4100131210.pdf.exe	RegSvcs.exe
PID 840 set thread context of 1200	840	RegSvcs.exe	Explorer.EXE
PID 916 set thread context of 1200	916	wlanext.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

RFQ_R4100131210.pdf.exeRegSvcs.exewlanext.exe

pid	process
1848	RFQ_R4100131210.pdf.exe
1848	RFQ_R4100131210.pdf.exe
840	RegSvcs.exe
840	RegSvcs.exe
916	wlanext.exe
916	wlanext.exe
916	wlanext.exe
916	wlanext.exe
916	wlanext.exe
916	wlanext.exe
916	wlanext.exe
916	wlanext.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

RegSvcs.exewlanext.exe

pid process

840 RegSvcs.exe
840 RegSvcs.exe
840 RegSvcs.exe
916 wlanext.exe
916 wlanext.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

RFQ_R4100131210.pdf.exeRegSvcs.exewlanext.exe

description pid process

Token: SeDebugPrivilege 1848 RFQ_R4100131210.pdf.exe
Token: SeDebugPrivilege 840 RegSvcs.exe
Token: SeDebugPrivilege 916 wlanext.exe

pid	process
840	RegSvcs.exe
840	RegSvcs.exe
840	RegSvcs.exe
916	wlanext.exe
916	wlanext.exe

description	pid	process
Token: SeDebugPrivilege	1848	RFQ_R4100131210.pdf.exe
Token: SeDebugPrivilege	840	RegSvcs.exe
Token: SeDebugPrivilege	916	wlanext.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

RFQ_R4100131210.pdf.exeExplorer.EXEwlanext.exe

description	pid	process	target process
PID 1848 wrote to memory of 840	1848	RFQ_R4100131210.pdf.exe	RegSvcs.exe
PID 1848 wrote to memory of 840	1848	RFQ_R4100131210.pdf.exe	RegSvcs.exe
PID 1848 wrote to memory of 840	1848	RFQ_R4100131210.pdf.exe	RegSvcs.exe
PID 1848 wrote to memory of 840	1848	RFQ_R4100131210.pdf.exe	RegSvcs.exe
PID 1848 wrote to memory of 840	1848	RFQ_R4100131210.pdf.exe	RegSvcs.exe
PID 1848 wrote to memory of 840	1848	RFQ_R4100131210.pdf.exe	RegSvcs.exe
PID 1848 wrote to memory of 840	1848	RFQ_R4100131210.pdf.exe	RegSvcs.exe
PID 1848 wrote to memory of 840	1848	RFQ_R4100131210.pdf.exe	RegSvcs.exe
PID 1848 wrote to memory of 840	1848	RFQ_R4100131210.pdf.exe	RegSvcs.exe
PID 1848 wrote to memory of 840	1848	RFQ_R4100131210.pdf.exe	RegSvcs.exe
PID 1200 wrote to memory of 916	1200	Explorer.EXE	wlanext.exe
PID 1200 wrote to memory of 916	1200	Explorer.EXE	wlanext.exe
PID 1200 wrote to memory of 916	1200	Explorer.EXE	wlanext.exe
PID 1200 wrote to memory of 916	1200	Explorer.EXE	wlanext.exe
PID 916 wrote to memory of 1152	916	wlanext.exe	cmd.exe
PID 916 wrote to memory of 1152	916	wlanext.exe	cmd.exe
PID 916 wrote to memory of 1152	916	wlanext.exe	cmd.exe
PID 916 wrote to memory of 1152	916	wlanext.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\RFQ_R4100131210.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_R4100131210.pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-68-0x000000000041D070-mapping.dmp

Download
memory/840-71-0x0000000000190000-0x00000000001A1000-memory.dmp

Filesize
68KB

Download
memory/840-70-0x00000000009E0000-0x0000000000CE3000-memory.dmp

Filesize
3.0MB

Download
memory/840-67-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/916-74-0x0000000000670000-0x0000000000686000-memory.dmp

Filesize
88KB

Download
memory/916-73-0x0000000000000000-mapping.dmp

Download
memory/916-78-0x00000000005E0000-0x0000000000670000-memory.dmp

Filesize
576KB

Download
memory/916-77-0x0000000001F40000-0x0000000002243000-memory.dmp

Filesize
3.0MB

Download
memory/916-75-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/1152-76-0x0000000000000000-mapping.dmp

Download
memory/1200-72-0x0000000004A30000-0x0000000004B4A000-memory.dmp

Filesize
1.1MB

Download
memory/1200-79-0x0000000006130000-0x0000000006230000-memory.dmp

Filesize
1024KB

Download
memory/1848-62-0x0000000001210000-0x0000000001211000-memory.dmp

Filesize
4KB

Download
memory/1848-60-0x0000000001300000-0x0000000001301000-memory.dmp

Filesize
4KB

Download
memory/1848-63-0x0000000000BD0000-0x0000000000BD9000-memory.dmp

Filesize
36KB

Download
memory/1848-66-0x00000000011B0000-0x00000000011EE000-memory.dmp

Filesize
248KB

Download
memory/1848-64-0x000000007EF40000-0x000000007EF41000-memory.dmp

Filesize
4KB

Download
memory/1848-65-0x0000000004BF0000-0x0000000004C72000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads