xloader | 81cbdffd1b44ca983180456d058b8eaadf51adbd19600dbbde68be7a4ef09a54

General

Target

Inv_7623980.exe
Size

957KB
MD5

ac0aafad021d642a83f0e0e00f925160
SHA1

9a225f4936ef458a3371e7681f942b7733d8eb25
SHA256

81cbdffd1b44ca983180456d058b8eaadf51adbd19600dbbde68be7a4ef09a54
SHA512

07683f8a9d789cc6e29a3ece064df8d9ba8e3d083a13c76cfeb669b75ecbfc0108669c3438a67fb9034a5fb98864680b6298d0c5506046f4d3581b08cb1d1504

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.inverservi.com/m6b5/

Decoy

ixtarbelize.com

pheamal.com

daiyncc.com

staydoubted.com

laagerlitigation.club

sukrantastansakarya.com

esupport.ltd

vetscontracting.net

themuslimlife.coach

salmanairs.com

somatictherapyservices.com

lastminuteminister.com

comunicarbuenosaires.com

kazuya.tech

insightlyservicedev.com

redevelopment38subhashnagar.com

thefutureinvestor.com

simplysu.com

lagu45.com

livingstonpistolpermit.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1740-64-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1740-65-0x000000000041D0F0-mapping.dmp	xloader
behavioral1/memory/1360-71-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

520 cmd.exe

pid	process
520	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Inv_7623980.exeInv_7623980.exehelp.exe

description	pid	process	target process
PID 1668 set thread context of 1740	1668	Inv_7623980.exe	Inv_7623980.exe
PID 1740 set thread context of 1248	1740	Inv_7623980.exe	Explorer.EXE
PID 1360 set thread context of 1248	1360	help.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

Inv_7623980.exehelp.exe

pid	process
1740	Inv_7623980.exe
1740	Inv_7623980.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe
1360	help.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1248 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Inv_7623980.exehelp.exe

pid process

1740 Inv_7623980.exe
1740 Inv_7623980.exe
1740 Inv_7623980.exe
1360 help.exe
1360 help.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Inv_7623980.exehelp.exe

description pid process

Token: SeDebugPrivilege 1740 Inv_7623980.exe
Token: SeDebugPrivilege 1360 help.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1248 Explorer.EXE
1248 Explorer.EXE
1248 Explorer.EXE
1248 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1248 Explorer.EXE
1248 Explorer.EXE
1248 Explorer.EXE
1248 Explorer.EXE

pid	process
1248	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1740	Inv_7623980.exe
Token: SeDebugPrivilege	1360	help.exe

pid	process
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE

pid	process
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Inv_7623980.exeExplorer.EXEhelp.exe

description	pid	process	target process
PID 1668 wrote to memory of 1740	1668	Inv_7623980.exe	Inv_7623980.exe
PID 1668 wrote to memory of 1740	1668	Inv_7623980.exe	Inv_7623980.exe
PID 1668 wrote to memory of 1740	1668	Inv_7623980.exe	Inv_7623980.exe
PID 1668 wrote to memory of 1740	1668	Inv_7623980.exe	Inv_7623980.exe
PID 1668 wrote to memory of 1740	1668	Inv_7623980.exe	Inv_7623980.exe
PID 1668 wrote to memory of 1740	1668	Inv_7623980.exe	Inv_7623980.exe
PID 1668 wrote to memory of 1740	1668	Inv_7623980.exe	Inv_7623980.exe
PID 1248 wrote to memory of 1360	1248	Explorer.EXE	help.exe
PID 1248 wrote to memory of 1360	1248	Explorer.EXE	help.exe
PID 1248 wrote to memory of 1360	1248	Explorer.EXE	help.exe
PID 1248 wrote to memory of 1360	1248	Explorer.EXE	help.exe
PID 1360 wrote to memory of 520	1360	help.exe	cmd.exe
PID 1360 wrote to memory of 520	1360	help.exe	cmd.exe
PID 1360 wrote to memory of 520	1360	help.exe	cmd.exe
PID 1360 wrote to memory of 520	1360	help.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248

C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe
"C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe
"C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"
3⤵
- Deletes itself
PID:520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/520-72-0x0000000000000000-mapping.dmp

Download
memory/1248-68-0x0000000006C70000-0x0000000006DBD000-memory.dmp

Filesize
1.3MB

Download
memory/1248-75-0x0000000006580000-0x00000000066AF000-memory.dmp

Filesize
1.2MB

Download
memory/1360-70-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/1360-73-0x00000000007F0000-0x0000000000AF3000-memory.dmp

Filesize
3.0MB

Download
memory/1360-69-0x0000000000000000-mapping.dmp

Download
memory/1360-76-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1360-74-0x0000000000B00000-0x0000000000B8F000-memory.dmp

Filesize
572KB

Download
memory/1360-71-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/1668-59-0x0000000001290000-0x0000000001291000-memory.dmp

Filesize
4KB

Download
memory/1668-61-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/1668-62-0x00000000008D0000-0x000000000094B000-memory.dmp

Filesize
492KB

Download
memory/1668-63-0x0000000000720000-0x000000000072F000-memory.dmp

Filesize
60KB

Download
memory/1740-65-0x000000000041D0F0-mapping.dmp

Download
memory/1740-67-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1740-64-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1740-66-0x0000000000700000-0x0000000000A03000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads