xloader | b32ad3bf2b79e411ca0450c1d5430d12c9bb73c269e0838ee512bc816fcce3b7

General

Target

74ed218c_by_Libranalysis.exe
Size

775KB
MD5

74ed218c2c421e3978445a1edbe40a08
SHA1

16d950eae07654c9805d4476928c4c8d7d12fcc1
SHA256

b32ad3bf2b79e411ca0450c1d5430d12c9bb73c269e0838ee512bc816fcce3b7
SHA512

0cb4af6ad1434d4140d0e055fc77de2543c9ea9babe077de27184b1628cbdc8f32530c5f0c2f4b3e1199459c0521e67415421525070c0870e75dc09105bf94d6

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.cats16.com/8u3b/

Decoy

pipienta.com

wisdomfest.net

jenniferreich.com

bigcanoehomesforless.com

kayandbernard.com

offerbuildingsecrets.com

benleefoto.com

contactlesssoftware.tech

statenislandplumbing.info

lifestylemedicineservices.com

blazerplanning.com

fnatic-skins.club

effectivemarketinginc.com

babyshopit.com

2000deal.com

k12paymentcemter.com

spwakd.com

lesreponses.com

abundando.com

hawkspremierfhc.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1044-66-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1044-67-0x000000000041D0A0-mapping.dmp	xloader
behavioral1/memory/1512-75-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1152 cmd.exe

pid	process
1152	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

74ed218c_by_Libranalysis.exe74ed218c_by_Libranalysis.execontrol.exe

description	pid	process	target process
PID 1840 set thread context of 1044	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1044 set thread context of 1200	1044	74ed218c_by_Libranalysis.exe	Explorer.EXE
PID 1512 set thread context of 1200	1512	control.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

74ed218c_by_Libranalysis.exe74ed218c_by_Libranalysis.execontrol.exe

pid	process
1840	74ed218c_by_Libranalysis.exe
1840	74ed218c_by_Libranalysis.exe
1840	74ed218c_by_Libranalysis.exe
1044	74ed218c_by_Libranalysis.exe
1044	74ed218c_by_Libranalysis.exe
1512	control.exe
1512	control.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

74ed218c_by_Libranalysis.execontrol.exe

pid process

1044 74ed218c_by_Libranalysis.exe
1044 74ed218c_by_Libranalysis.exe
1044 74ed218c_by_Libranalysis.exe
1512 control.exe
1512 control.exe

pid	process
1044	74ed218c_by_Libranalysis.exe
1044	74ed218c_by_Libranalysis.exe
1044	74ed218c_by_Libranalysis.exe
1512	control.exe
1512	control.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

74ed218c_by_Libranalysis.exe74ed218c_by_Libranalysis.execontrol.exe

description	pid	process
Token: SeDebugPrivilege	1840	74ed218c_by_Libranalysis.exe
Token: SeDebugPrivilege	1044	74ed218c_by_Libranalysis.exe
Token: SeDebugPrivilege	1512	control.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

74ed218c_by_Libranalysis.exeExplorer.EXEcontrol.exe

description	pid	process	target process
PID 1840 wrote to memory of 1796	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 1796	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 1796	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 1796	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 752	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 752	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 752	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 752	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 1696	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 1696	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 1696	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 1696	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 1044	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 1044	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 1044	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 1044	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 1044	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 1044	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1840 wrote to memory of 1044	1840	74ed218c_by_Libranalysis.exe	74ed218c_by_Libranalysis.exe
PID 1200 wrote to memory of 1512	1200	Explorer.EXE	control.exe
PID 1200 wrote to memory of 1512	1200	Explorer.EXE	control.exe
PID 1200 wrote to memory of 1512	1200	Explorer.EXE	control.exe
PID 1200 wrote to memory of 1512	1200	Explorer.EXE	control.exe
PID 1512 wrote to memory of 1152	1512	control.exe	cmd.exe
PID 1512 wrote to memory of 1152	1512	control.exe	cmd.exe
PID 1512 wrote to memory of 1152	1512	control.exe	cmd.exe
PID 1512 wrote to memory of 1152	1512	control.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\74ed218c_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\74ed218c_by_Libranalysis.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840

C:\Users\Admin\AppData\Local\Temp\74ed218c_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\74ed218c_by_Libranalysis.exe"
3⤵
PID:1796

C:\Users\Admin\AppData\Local\Temp\74ed218c_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\74ed218c_by_Libranalysis.exe"
3⤵
PID:752

C:\Users\Admin\AppData\Local\Temp\74ed218c_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\74ed218c_by_Libranalysis.exe"
3⤵
PID:1696

C:\Users\Admin\AppData\Local\Temp\74ed218c_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\74ed218c_by_Libranalysis.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1044

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\74ed218c_by_Libranalysis.exe"
3⤵
- Deletes itself
PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-69-0x00000000008B0000-0x0000000000BB3000-memory.dmp

Filesize
3.0MB

Download
memory/1044-70-0x0000000000240000-0x0000000000251000-memory.dmp

Filesize
68KB

Download
memory/1044-66-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1044-67-0x000000000041D0A0-mapping.dmp

Download
memory/1152-77-0x0000000000000000-mapping.dmp

Download
memory/1200-79-0x00000000063D0000-0x000000000650C000-memory.dmp

Filesize
1.2MB

Download
memory/1200-71-0x0000000006130000-0x0000000006241000-memory.dmp

Filesize
1.1MB

Download
memory/1512-74-0x0000000000950000-0x000000000096F000-memory.dmp

Filesize
124KB

Download
memory/1512-72-0x0000000000000000-mapping.dmp

Download
memory/1512-73-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/1512-75-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/1512-76-0x0000000002040000-0x0000000002343000-memory.dmp

Filesize
3.0MB

Download
memory/1512-78-0x0000000001E00000-0x0000000001E90000-memory.dmp

Filesize
576KB

Download
memory/1840-65-0x0000000004790000-0x00000000047F2000-memory.dmp

Filesize
392KB

Download
memory/1840-64-0x0000000005010000-0x00000000050B8000-memory.dmp

Filesize
672KB

Download
memory/1840-60-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1840-63-0x00000000005C0000-0x00000000005CE000-memory.dmp

Filesize
56KB

Download
memory/1840-62-0x0000000004000000-0x0000000004001000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads