xloader | 3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61

General

Target

3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
Size

767KB
MD5

0ddeb0b17f45b044ca999164550dd25c
SHA1

98c59b8743624e0354d47e51ccbc52d37c2260ec
SHA256

3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61
SHA512

83e87605ba0e523d9f1c215e2695f95d5a5f886e0151412212ec7c9abd0acebca5a2f2fd42df4fc292fc8ba72991cb38b8426179d4f103c1389ba6b44e8fe917

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.partypacktv.net/a3ea/

Decoy

yvsgge.com

shooter2.com

ugcfashion.com

deltaefficiencies.com

raidertomb.com

atiempoconguadalupe.com

whmmhh.com

hangar360aircraft.com

toughcookiemasks.store

blindowlch.com

yipo.info

mindsomamove.com

theresalobstahlike.com

nova-select.com

socetegen.com

platinaman.com

datsu-nihon.com

jumpstartinggenius.com

slxplay.com

rightwaysdecor.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1340-128-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral2/memory/1340-129-0x000000000041D030-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

description	pid	process	target process
PID 3008 set thread context of 1340	3008	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

pid	process
3008	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
3008	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
1340	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
1340	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

description pid process

Token: SeDebugPrivilege 3008 3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

description	pid	process
Token: SeDebugPrivilege	3008	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

description	pid	process	target process
PID 3008 wrote to memory of 1340	3008	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
PID 3008 wrote to memory of 1340	3008	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
PID 3008 wrote to memory of 1340	3008	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
PID 3008 wrote to memory of 1340	3008	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
PID 3008 wrote to memory of 1340	3008	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
PID 3008 wrote to memory of 1340	3008	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe	3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe

C:\Users\Admin\AppData\Local\Temp\3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
"C:\Users\Admin\AppData\Local\Temp\3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
  C:\Users\Admin\AppData\Local\Temp\3be492c34e92a83547b0d1656e21f2d8aed8f7448fcb9f720b401c9daa26fc61.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-128-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1340-129-0x000000000041D030-mapping.dmp

Download
memory/1340-130-0x00000000010E0000-0x0000000001400000-memory.dmp

Filesize
3.1MB

Download
memory/3008-114-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/3008-116-0x0000000005CC0000-0x0000000005CC1000-memory.dmp

Filesize
4KB

Download
memory/3008-117-0x00000000057C0000-0x00000000057C1000-memory.dmp

Filesize
4KB

Download
memory/3008-118-0x00000000057C0000-0x0000000005CBE000-memory.dmp

Filesize
5.0MB

Download
memory/3008-119-0x00000000058B0000-0x00000000058B1000-memory.dmp

Filesize
4KB

Download
memory/3008-120-0x00000000072C0000-0x0000000007321000-memory.dmp

Filesize
388KB

Download
memory/3008-121-0x00000000073B0000-0x00000000073B1000-memory.dmp

Filesize
4KB

Download
memory/3008-126-0x0000000007C70000-0x0000000007CE8000-memory.dmp

Filesize
480KB

Download
memory/3008-127-0x0000000007D60000-0x0000000007D61000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads