xloader | d390d8a528c62a458cb66745b0245eaf4721c9e3f3cea7ba75d16fae31a392b4

General

Target

F2123122_quantity_increased,pdf.exe
Size

790KB
MD5

d973b6745ca038d514b04f5495348027
SHA1

23a7a5dd2bad6931c491e15244bffb19e6d975fa
SHA256

d390d8a528c62a458cb66745b0245eaf4721c9e3f3cea7ba75d16fae31a392b4
SHA512

6869f55bcbc8259360c3a967a627c61bfbb872d2504258c39c4f22043ac1d04e954bb250a7fcba035dce5e486d689dfe985bafd07dd4ae0a32e90e68b7e5b72e

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.liancaiwangv5.com/oerg/

Decoy

brightly-common.com

petwellness.pet

oldhamluxury.com

cmpembroidery.com

physicalrobot.com

irynazumba.com

testyourself11.com

theblacksportswoman.com

mottestertraining.agency

confrontinghate.info

tamiigun.com

pod14.club

implementnowsolutions.net

letsdance.website

cashforkeysdz.net

grupoprotecsasac.com

kol-lek-tiv.net

funeralhomesmaroail.com

lwfunding.com

junkglobal.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2680-116-0x000000000041D050-mapping.dmp	xloader
behavioral2/memory/2680-115-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

F2123122_quantity_increased,pdf.exe

description pid process target process

PID 604 set thread context of 2680 604 F2123122_quantity_increased,pdf.exe F2123122_quantity_increased,pdf.exe

description	pid	process	target process
PID 604 set thread context of 2680	604	F2123122_quantity_increased,pdf.exe	F2123122_quantity_increased,pdf.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

F2123122_quantity_increased,pdf.exeF2123122_quantity_increased,pdf.exe

pid	process
604	F2123122_quantity_increased,pdf.exe
604	F2123122_quantity_increased,pdf.exe
2680	F2123122_quantity_increased,pdf.exe
2680	F2123122_quantity_increased,pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

F2123122_quantity_increased,pdf.exe

description pid process

Token: SeDebugPrivilege 604 F2123122_quantity_increased,pdf.exe

description	pid	process
Token: SeDebugPrivilege	604	F2123122_quantity_increased,pdf.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

F2123122_quantity_increased,pdf.exe

description	pid	process	target process
PID 604 wrote to memory of 3708	604	F2123122_quantity_increased,pdf.exe	F2123122_quantity_increased,pdf.exe
PID 604 wrote to memory of 3708	604	F2123122_quantity_increased,pdf.exe	F2123122_quantity_increased,pdf.exe
PID 604 wrote to memory of 3708	604	F2123122_quantity_increased,pdf.exe	F2123122_quantity_increased,pdf.exe
PID 604 wrote to memory of 2680	604	F2123122_quantity_increased,pdf.exe	F2123122_quantity_increased,pdf.exe
PID 604 wrote to memory of 2680	604	F2123122_quantity_increased,pdf.exe	F2123122_quantity_increased,pdf.exe
PID 604 wrote to memory of 2680	604	F2123122_quantity_increased,pdf.exe	F2123122_quantity_increased,pdf.exe
PID 604 wrote to memory of 2680	604	F2123122_quantity_increased,pdf.exe	F2123122_quantity_increased,pdf.exe
PID 604 wrote to memory of 2680	604	F2123122_quantity_increased,pdf.exe	F2123122_quantity_increased,pdf.exe
PID 604 wrote to memory of 2680	604	F2123122_quantity_increased,pdf.exe	F2123122_quantity_increased,pdf.exe

C:\Users\Admin\AppData\Local\Temp\F2123122_quantity_increased,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\F2123122_quantity_increased,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:604

C:\Users\Admin\AppData\Local\Temp\F2123122_quantity_increased,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\F2123122_quantity_increased,pdf.exe"
2⤵
PID:3708

C:\Users\Admin\AppData\Local\Temp\F2123122_quantity_increased,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\F2123122_quantity_increased,pdf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2680

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/604-114-0x0000000002A70000-0x0000000002A71000-memory.dmp

Filesize
4KB

Download
memory/2680-116-0x000000000041D050-mapping.dmp

Download
memory/2680-115-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2680-118-0x0000000001710000-0x0000000001A30000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads