xloader | 3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61

General

Target

3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
Size

767KB
MD5

0ddeb0b17f45b044ca999164550dd25c
SHA1

98c59b8743624e0354d47e51ccbc52d37c2260ec
SHA256

3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61
SHA512

83e87605ba0e523d9f1c215e2695f95d5a5f886e0151412212ec7c9abd0acebca5a2f2fd42df4fc292fc8ba72991cb38b8426179d4f103c1389ba6b44e8fe917

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.partypacktv.net/a3ea/

Decoy

yvsgge.com

shooter2.com

ugcfashion.com

deltaefficiencies.com

raidertomb.com

atiempoconguadalupe.com

whmmhh.com

hangar360aircraft.com

toughcookiemasks.store

blindowlch.com

yipo.info

mindsomamove.com

theresalobstahlike.com

nova-select.com

socetegen.com

platinaman.com

datsu-nihon.com

jumpstartinggenius.com

slxplay.com

rightwaysdecor.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1968-128-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/1968-129-0x000000000041D030-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

description	pid	process	target process
PID 568 set thread context of 1968	568	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

pid	process
568	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
568	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
1968	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
1968	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

description pid process

Token: SeDebugPrivilege 568 3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

description	pid	process
Token: SeDebugPrivilege	568	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

description	pid	process	target process
PID 568 wrote to memory of 1968	568	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
PID 568 wrote to memory of 1968	568	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
PID 568 wrote to memory of 1968	568	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
PID 568 wrote to memory of 1968	568	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
PID 568 wrote to memory of 1968	568	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
PID 568 wrote to memory of 1968	568	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

C:\Users\Admin\AppData\Local\Temp\3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
"C:\Users\Admin\AppData\Local\Temp\3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568
- C:\Users\Admin\AppData\Local\Temp\3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
  C:\Users\Admin\AppData\Local\Temp\3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-114-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/568-116-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download
memory/568-117-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/568-118-0x0000000004B90000-0x0000000004C22000-memory.dmp

Filesize
584KB

Download
memory/568-119-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/568-120-0x0000000006770000-0x00000000067D1000-memory.dmp

Filesize
388KB

Download
memory/568-121-0x0000000006860000-0x0000000006861000-memory.dmp

Filesize
4KB

Download
memory/568-126-0x0000000007190000-0x0000000007208000-memory.dmp

Filesize
480KB

Download
memory/568-127-0x0000000007230000-0x0000000007231000-memory.dmp

Filesize
4KB

Download
memory/1968-128-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1968-129-0x000000000041D030-mapping.dmp

Download
memory/1968-130-0x0000000000E50000-0x0000000001170000-memory.dmp

Filesize
3.1MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads