xloader | fb41c68e0f07ce1cce78c5e0a8eee7f24fd8024fff1642dab1830b82f34414a8

General

Target

zeO9m3gOpDWG5B4.bin.exe
Size

694KB
MD5

f1505c03ec89a6e428d192f2ecaa6b76
SHA1

dfc541fbadaaaa3e2184112cf969a6db32cb8da4
SHA256

9b4bcf870a79699cea2ef0add03b741bf14296f50b089a648f57903519eb8e7e
SHA512

7e35e606644f9c8530b321d5a1f2d8138644f987ca6c2ac7dc2fa2661123a3422589a50a86cbfc3837577cc35750b12e11acf26388348afcbb34a855fd834861

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.brackishcompany.com/b2w3/

Decoy

turnongrowth.com

jc0019.com

myburlingtonfeedback.com

orlandobestsolution.site

newmillenniumgaming.com

dynalink.life

unityr.com

printedcactus.com

sevenlivesmedia.com

sigfox.site

arossoevents.com

fierceferal.com

jminsulation.company

comenothayarc.com

aurasellsrealestate.com

ddcfstore.com

nuwaves22.com

uuoouu-2.store

cogswellstestcogs.com

blockmoneybranding.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1632-125-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/1632-126-0x000000000041D080-mapping.dmp	xloader
behavioral2/memory/2712-132-0x0000000000B20000-0x0000000000B49000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

Processes:

zeO9m3gOpDWG5B4.bin.exezeO9m3gOpDWG5B4.bin.exesvchost.exe

description	pid	process	target process
PID 1868 set thread context of 1632	1868	zeO9m3gOpDWG5B4.bin.exe	zeO9m3gOpDWG5B4.bin.exe
PID 1632 set thread context of 2376	1632	zeO9m3gOpDWG5B4.bin.exe	Explorer.EXE
PID 2712 set thread context of 2376	2712	svchost.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 38 IoCs

Processes:

zeO9m3gOpDWG5B4.bin.exesvchost.exe

pid	process
1632	zeO9m3gOpDWG5B4.bin.exe
1632	zeO9m3gOpDWG5B4.bin.exe
1632	zeO9m3gOpDWG5B4.bin.exe
1632	zeO9m3gOpDWG5B4.bin.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2376 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

zeO9m3gOpDWG5B4.bin.exesvchost.exe

pid process

1632 zeO9m3gOpDWG5B4.bin.exe
1632 zeO9m3gOpDWG5B4.bin.exe
1632 zeO9m3gOpDWG5B4.bin.exe
2712 svchost.exe
2712 svchost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

zeO9m3gOpDWG5B4.bin.exesvchost.exe

description pid process

Token: SeDebugPrivilege 1632 zeO9m3gOpDWG5B4.bin.exe
Token: SeDebugPrivilege 2712 svchost.exe

pid	process
2376	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1632	zeO9m3gOpDWG5B4.bin.exe
Token: SeDebugPrivilege	2712	svchost.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

zeO9m3gOpDWG5B4.bin.exeExplorer.EXEsvchost.exe

description	pid	process	target process
PID 1868 wrote to memory of 1632	1868	zeO9m3gOpDWG5B4.bin.exe	zeO9m3gOpDWG5B4.bin.exe
PID 1868 wrote to memory of 1632	1868	zeO9m3gOpDWG5B4.bin.exe	zeO9m3gOpDWG5B4.bin.exe
PID 1868 wrote to memory of 1632	1868	zeO9m3gOpDWG5B4.bin.exe	zeO9m3gOpDWG5B4.bin.exe
PID 1868 wrote to memory of 1632	1868	zeO9m3gOpDWG5B4.bin.exe	zeO9m3gOpDWG5B4.bin.exe
PID 1868 wrote to memory of 1632	1868	zeO9m3gOpDWG5B4.bin.exe	zeO9m3gOpDWG5B4.bin.exe
PID 1868 wrote to memory of 1632	1868	zeO9m3gOpDWG5B4.bin.exe	zeO9m3gOpDWG5B4.bin.exe
PID 2376 wrote to memory of 2712	2376	Explorer.EXE	svchost.exe
PID 2376 wrote to memory of 2712	2376	Explorer.EXE	svchost.exe
PID 2376 wrote to memory of 2712	2376	Explorer.EXE	svchost.exe
PID 2712 wrote to memory of 1604	2712	svchost.exe	cmd.exe
PID 2712 wrote to memory of 1604	2712	svchost.exe	cmd.exe
PID 2712 wrote to memory of 1604	2712	svchost.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2376

C:\Users\Admin\AppData\Local\Temp\zeO9m3gOpDWG5B4.bin.exe
"C:\Users\Admin\AppData\Local\Temp\zeO9m3gOpDWG5B4.bin.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1868

C:\Users\Admin\AppData\Local\Temp\zeO9m3gOpDWG5B4.bin.exe
"C:\Users\Admin\AppData\Local\Temp\zeO9m3gOpDWG5B4.bin.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\zeO9m3gOpDWG5B4.bin.exe"
3⤵
PID:1604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1604-134-0x0000000000000000-mapping.dmp

Download
memory/1632-125-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1632-128-0x00000000011A0000-0x00000000011B1000-memory.dmp

Filesize
68KB

Download
memory/1632-127-0x00000000011C0000-0x00000000014E0000-memory.dmp

Filesize
3.1MB

Download
memory/1632-126-0x000000000041D080-mapping.dmp

Download
memory/1868-120-0x0000000005570000-0x0000000005571000-memory.dmp

Filesize
4KB

Download
memory/1868-116-0x00000000054C0000-0x0000000005569000-memory.dmp

Filesize
676KB

Download
memory/1868-122-0x00000000056F0000-0x000000000570B000-memory.dmp

Filesize
108KB

Download
memory/1868-123-0x00000000015A0000-0x0000000001615000-memory.dmp

Filesize
468KB

Download
memory/1868-124-0x0000000001620000-0x0000000001650000-memory.dmp

Filesize
192KB

Download
memory/1868-114-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/1868-119-0x000000000AB90000-0x000000000AB91000-memory.dmp

Filesize
4KB

Download
memory/1868-118-0x000000000AA50000-0x000000000AA51000-memory.dmp

Filesize
4KB

Download
memory/1868-117-0x000000000AF50000-0x000000000AF51000-memory.dmp

Filesize
4KB

Download
memory/1868-121-0x0000000003050000-0x0000000003051000-memory.dmp

Filesize
4KB

Download
memory/2376-129-0x0000000000A20000-0x0000000000B34000-memory.dmp

Filesize
1.1MB

Download
memory/2376-136-0x0000000002940000-0x0000000002A3D000-memory.dmp

Filesize
1012KB

Download
memory/2712-132-0x0000000000B20000-0x0000000000B49000-memory.dmp

Filesize
164KB

Download
memory/2712-133-0x0000000003920000-0x0000000003C40000-memory.dmp

Filesize
3.1MB

Download
memory/2712-131-0x0000000001040000-0x000000000104C000-memory.dmp

Filesize
48KB

Download
memory/2712-130-0x0000000000000000-mapping.dmp

Download
memory/2712-135-0x0000000003300000-0x0000000003390000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads