xloader | 703a9d816bb422e4d2adeee4f7b6df250bf0441004c0939a03e927400420d9b9

General

Target

ada8b1320a6f303fbd5c09d3dab2235a.exe
Size

734KB
MD5

ada8b1320a6f303fbd5c09d3dab2235a
SHA1

127abb366bfbc70bdb90d0339333b02261eb2140
SHA256

703a9d816bb422e4d2adeee4f7b6df250bf0441004c0939a03e927400420d9b9
SHA512

64e7c304b70911735ad1225d9ad080805f5667b63216308906bb8d8a8463c01dfd1dc43c0b62ebca0c3eab2831d8d17889f4205bfece85e4fc0dfaaca5f98f76

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.ejsuniqueclasses.com/f0sg/

Decoy

deondevemaagua.com

highcolorchem.com

remax-pros-sd.com

smartmotiontrans.com

staltower.com

raiseamerican.com

io-tonix.com

llawenydd.com

minkladieshaircollections.com

ataria.net

roofers-baltimore.com

infinityventura.com

dvdxbase.com

babebrowpen.com

rascontractingllc.com

designingdreamshome.com

groobefunnels.com

americanstatesapparel.com

theketodesserts.com

bend-a-knee.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/308-66-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/308-67-0x000000000041D0A0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

ada8b1320a6f303fbd5c09d3dab2235a.exe

description pid process target process

PID 1088 set thread context of 308 1088 ada8b1320a6f303fbd5c09d3dab2235a.exe ada8b1320a6f303fbd5c09d3dab2235a.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ada8b1320a6f303fbd5c09d3dab2235a.exe

pid process

308 ada8b1320a6f303fbd5c09d3dab2235a.exe

description	pid	process	target process
PID 1088 set thread context of 308	1088	ada8b1320a6f303fbd5c09d3dab2235a.exe	ada8b1320a6f303fbd5c09d3dab2235a.exe

pid	process
308	ada8b1320a6f303fbd5c09d3dab2235a.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

ada8b1320a6f303fbd5c09d3dab2235a.exe

description	pid	process	target process
PID 1088 wrote to memory of 308	1088	ada8b1320a6f303fbd5c09d3dab2235a.exe	ada8b1320a6f303fbd5c09d3dab2235a.exe
PID 1088 wrote to memory of 308	1088	ada8b1320a6f303fbd5c09d3dab2235a.exe	ada8b1320a6f303fbd5c09d3dab2235a.exe
PID 1088 wrote to memory of 308	1088	ada8b1320a6f303fbd5c09d3dab2235a.exe	ada8b1320a6f303fbd5c09d3dab2235a.exe
PID 1088 wrote to memory of 308	1088	ada8b1320a6f303fbd5c09d3dab2235a.exe	ada8b1320a6f303fbd5c09d3dab2235a.exe
PID 1088 wrote to memory of 308	1088	ada8b1320a6f303fbd5c09d3dab2235a.exe	ada8b1320a6f303fbd5c09d3dab2235a.exe
PID 1088 wrote to memory of 308	1088	ada8b1320a6f303fbd5c09d3dab2235a.exe	ada8b1320a6f303fbd5c09d3dab2235a.exe
PID 1088 wrote to memory of 308	1088	ada8b1320a6f303fbd5c09d3dab2235a.exe	ada8b1320a6f303fbd5c09d3dab2235a.exe

C:\Users\Admin\AppData\Local\Temp\ada8b1320a6f303fbd5c09d3dab2235a.exe
"C:\Users\Admin\AppData\Local\Temp\ada8b1320a6f303fbd5c09d3dab2235a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1088

C:\Users\Admin\AppData\Local\Temp\ada8b1320a6f303fbd5c09d3dab2235a.exe
"C:\Users\Admin\AppData\Local\Temp\ada8b1320a6f303fbd5c09d3dab2235a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/308-66-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/308-67-0x000000000041D0A0-mapping.dmp

Download
memory/308-69-0x00000000009E0000-0x0000000000CE3000-memory.dmp

Filesize
3.0MB

Download
memory/1088-60-0x0000000001120000-0x0000000001121000-memory.dmp

Filesize
4KB

Download
memory/1088-62-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/1088-63-0x0000000000370000-0x000000000037E000-memory.dmp

Filesize
56KB

Download
memory/1088-64-0x0000000005230000-0x00000000052D7000-memory.dmp

Filesize
668KB

Download
memory/1088-65-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download

Analysis

Sharing