xloader | fb41c68e0f07ce1cce78c5e0a8eee7f24fd8024fff1642dab1830b82f34414a8

General

Target

zeO9m3gOpDWG5B4.bin.exe
Size

694KB
MD5

f1505c03ec89a6e428d192f2ecaa6b76
SHA1

dfc541fbadaaaa3e2184112cf969a6db32cb8da4
SHA256

9b4bcf870a79699cea2ef0add03b741bf14296f50b089a648f57903519eb8e7e
SHA512

7e35e606644f9c8530b321d5a1f2d8138644f987ca6c2ac7dc2fa2661123a3422589a50a86cbfc3837577cc35750b12e11acf26388348afcbb34a855fd834861

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.brackishcompany.com/b2w3/

Decoy

turnongrowth.com

jc0019.com

myburlingtonfeedback.com

orlandobestsolution.site

newmillenniumgaming.com

dynalink.life

unityr.com

printedcactus.com

sevenlivesmedia.com

sigfox.site

arossoevents.com

fierceferal.com

jminsulation.company

comenothayarc.com

aurasellsrealestate.com

ddcfstore.com

nuwaves22.com

uuoouu-2.store

cogswellstestcogs.com

blockmoneybranding.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/656-67-0x000000000041D080-mapping.dmp	xloader
behavioral1/memory/656-66-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/328-74-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

712 cmd.exe

pid	process
712	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

zeO9m3gOpDWG5B4.bin.exezeO9m3gOpDWG5B4.bin.exewininit.exe

description	pid	process	target process
PID 1076 set thread context of 656	1076	zeO9m3gOpDWG5B4.bin.exe	zeO9m3gOpDWG5B4.bin.exe
PID 656 set thread context of 1264	656	zeO9m3gOpDWG5B4.bin.exe	Explorer.EXE
PID 328 set thread context of 1264	328	wininit.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

zeO9m3gOpDWG5B4.bin.exewininit.exe

pid	process
656	zeO9m3gOpDWG5B4.bin.exe
656	zeO9m3gOpDWG5B4.bin.exe
328	wininit.exe
328	wininit.exe
328	wininit.exe
328	wininit.exe
328	wininit.exe
328	wininit.exe
328	wininit.exe
328	wininit.exe
328	wininit.exe
328	wininit.exe
328	wininit.exe
328	wininit.exe
328	wininit.exe
328	wininit.exe
328	wininit.exe
328	wininit.exe
328	wininit.exe
328	wininit.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

zeO9m3gOpDWG5B4.bin.exewininit.exe

pid process

656 zeO9m3gOpDWG5B4.bin.exe
656 zeO9m3gOpDWG5B4.bin.exe
656 zeO9m3gOpDWG5B4.bin.exe
328 wininit.exe
328 wininit.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

zeO9m3gOpDWG5B4.bin.exewininit.exe

description pid process

Token: SeDebugPrivilege 656 zeO9m3gOpDWG5B4.bin.exe
Token: SeDebugPrivilege 328 wininit.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1264 Explorer.EXE
1264 Explorer.EXE
1264 Explorer.EXE
1264 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1264 Explorer.EXE
1264 Explorer.EXE
1264 Explorer.EXE
1264 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	656	zeO9m3gOpDWG5B4.bin.exe
Token: SeDebugPrivilege	328	wininit.exe

pid	process
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE

pid	process
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

zeO9m3gOpDWG5B4.bin.exeExplorer.EXEwininit.exe

description	pid	process	target process
PID 1076 wrote to memory of 656	1076	zeO9m3gOpDWG5B4.bin.exe	zeO9m3gOpDWG5B4.bin.exe
PID 1076 wrote to memory of 656	1076	zeO9m3gOpDWG5B4.bin.exe	zeO9m3gOpDWG5B4.bin.exe
PID 1076 wrote to memory of 656	1076	zeO9m3gOpDWG5B4.bin.exe	zeO9m3gOpDWG5B4.bin.exe
PID 1076 wrote to memory of 656	1076	zeO9m3gOpDWG5B4.bin.exe	zeO9m3gOpDWG5B4.bin.exe
PID 1076 wrote to memory of 656	1076	zeO9m3gOpDWG5B4.bin.exe	zeO9m3gOpDWG5B4.bin.exe
PID 1076 wrote to memory of 656	1076	zeO9m3gOpDWG5B4.bin.exe	zeO9m3gOpDWG5B4.bin.exe
PID 1076 wrote to memory of 656	1076	zeO9m3gOpDWG5B4.bin.exe	zeO9m3gOpDWG5B4.bin.exe
PID 1264 wrote to memory of 328	1264	Explorer.EXE	wininit.exe
PID 1264 wrote to memory of 328	1264	Explorer.EXE	wininit.exe
PID 1264 wrote to memory of 328	1264	Explorer.EXE	wininit.exe
PID 1264 wrote to memory of 328	1264	Explorer.EXE	wininit.exe
PID 328 wrote to memory of 712	328	wininit.exe	cmd.exe
PID 328 wrote to memory of 712	328	wininit.exe	cmd.exe
PID 328 wrote to memory of 712	328	wininit.exe	cmd.exe
PID 328 wrote to memory of 712	328	wininit.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264

C:\Users\Admin\AppData\Local\Temp\zeO9m3gOpDWG5B4.bin.exe
"C:\Users\Admin\AppData\Local\Temp\zeO9m3gOpDWG5B4.bin.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1076

C:\Users\Admin\AppData\Local\Temp\zeO9m3gOpDWG5B4.bin.exe
"C:\Users\Admin\AppData\Local\Temp\zeO9m3gOpDWG5B4.bin.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:656

C:\Windows\SysWOW64\wininit.exe
"C:\Windows\SysWOW64\wininit.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:328

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\zeO9m3gOpDWG5B4.bin.exe"
3⤵
- Deletes itself
PID:712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/328-76-0x0000000001DE0000-0x0000000001E70000-memory.dmp

Filesize
576KB

Download
memory/328-75-0x0000000002020000-0x0000000002323000-memory.dmp

Filesize
3.0MB

Download
memory/328-74-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/328-73-0x0000000000610000-0x000000000062A000-memory.dmp

Filesize
104KB

Download
memory/328-71-0x0000000000000000-mapping.dmp

Download
memory/656-68-0x0000000000A20000-0x0000000000D23000-memory.dmp

Filesize
3.0MB

Download
memory/656-67-0x000000000041D080-mapping.dmp

Download
memory/656-66-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/656-69-0x0000000000290000-0x00000000002A1000-memory.dmp

Filesize
68KB

Download
memory/712-72-0x0000000000000000-mapping.dmp

Download
memory/1076-65-0x00000000005F0000-0x0000000000620000-memory.dmp

Filesize
192KB

Download
memory/1076-59-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1076-64-0x0000000004E00000-0x0000000004E75000-memory.dmp

Filesize
468KB

Download
memory/1076-63-0x0000000000240000-0x000000000025B000-memory.dmp

Filesize
108KB

Download
memory/1076-62-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download
memory/1076-61-0x0000000004980000-0x0000000004A29000-memory.dmp

Filesize
676KB

Download
memory/1264-70-0x0000000006850000-0x0000000006942000-memory.dmp

Filesize
968KB

Download
memory/1264-77-0x0000000006EE0000-0x0000000006F97000-memory.dmp

Filesize
732KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads