xloader | a544b4050677d9e5ad964398954cf7d74c96b65a1126a8bb3491fbe52ff0ec10

Analysis

max time kernel
150s
max time network
178s
platform
windows7_x64
resource
win7v20210410
submitted
27-07-2021 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27-07-2021/27-07-2021/Inv_7623980.exe
Size

957KB
MD5

ac0aafad021d642a83f0e0e00f925160
SHA1

9a225f4936ef458a3371e7681f942b7733d8eb25
SHA256

81cbdffd1b44ca983180456d058b8eaadf51adbd19600dbbde68be7a4ef09a54
SHA512

07683f8a9d789cc6e29a3ece064df8d9ba8e3d083a13c76cfeb669b75ecbfc0108669c3438a67fb9034a5fb98864680b6298d0c5506046f4d3581b08cb1d1504

Score

10^/10

xloader loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.3

http://www.inverservi.com/m6b5/

Decoy

ixtarbelize.com

pheamal.com

daiyncc.com

staydoubted.com

laagerlitigation.club

sukrantastansakarya.com

esupport.ltd

vetscontracting.net

themuslimlife.coach

salmanairs.com

somatictherapyservices.com

lastminuteminister.com

comunicarbuenosaires.com

kazuya.tech

insightlyservicedev.com

redevelopment38subhashnagar.com

thefutureinvestor.com

simplysu.com

lagu45.com

livingstonpistolpermit.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral11/memory/1976-64-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral11/memory/1976-65-0x000000000041D0F0-mapping.dmp	xloader
behavioral11/memory/1776-73-0x0000000000090000-0x00000000000B9000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

332 cmd.exe

pid	process
332	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Inv_7623980.exeInv_7623980.execmstp.exe

description	pid	process	target process
PID 1660 set thread context of 1976	1660	Inv_7623980.exe	Inv_7623980.exe
PID 1976 set thread context of 1208	1976	Inv_7623980.exe	Explorer.EXE
PID 1776 set thread context of 1208	1776	cmstp.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 33 IoCs

Processes:

Inv_7623980.exeInv_7623980.execmstp.exe

pid	process
1660	Inv_7623980.exe
1660	Inv_7623980.exe
1976	Inv_7623980.exe
1976	Inv_7623980.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe
1776	cmstp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1208 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Inv_7623980.execmstp.exe

pid process

1976 Inv_7623980.exe
1976 Inv_7623980.exe
1976 Inv_7623980.exe
1776 cmstp.exe
1776 cmstp.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Inv_7623980.exeInv_7623980.execmstp.exe

description pid process

Token: SeDebugPrivilege 1660 Inv_7623980.exe
Token: SeDebugPrivilege 1976 Inv_7623980.exe
Token: SeDebugPrivilege 1776 cmstp.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1208 Explorer.EXE
1208 Explorer.EXE
1208 Explorer.EXE
1208 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1208 Explorer.EXE
1208 Explorer.EXE
1208 Explorer.EXE
1208 Explorer.EXE

pid	process
1208	Explorer.EXE

pid	process
1976	Inv_7623980.exe
1976	Inv_7623980.exe
1976	Inv_7623980.exe
1776	cmstp.exe
1776	cmstp.exe

description	pid	process
Token: SeDebugPrivilege	1660	Inv_7623980.exe
Token: SeDebugPrivilege	1976	Inv_7623980.exe
Token: SeDebugPrivilege	1776	cmstp.exe

pid	process
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE

pid	process
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE
1208	Explorer.EXE

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

Inv_7623980.exeExplorer.EXEcmstp.exe

description	pid	process	target process
PID 1660 wrote to memory of 1992	1660	Inv_7623980.exe	Inv_7623980.exe
PID 1660 wrote to memory of 1992	1660	Inv_7623980.exe	Inv_7623980.exe
PID 1660 wrote to memory of 1992	1660	Inv_7623980.exe	Inv_7623980.exe
PID 1660 wrote to memory of 1992	1660	Inv_7623980.exe	Inv_7623980.exe
PID 1660 wrote to memory of 1988	1660	Inv_7623980.exe	Inv_7623980.exe
PID 1660 wrote to memory of 1988	1660	Inv_7623980.exe	Inv_7623980.exe
PID 1660 wrote to memory of 1988	1660	Inv_7623980.exe	Inv_7623980.exe
PID 1660 wrote to memory of 1988	1660	Inv_7623980.exe	Inv_7623980.exe
PID 1660 wrote to memory of 1976	1660	Inv_7623980.exe	Inv_7623980.exe
PID 1660 wrote to memory of 1976	1660	Inv_7623980.exe	Inv_7623980.exe
PID 1660 wrote to memory of 1976	1660	Inv_7623980.exe	Inv_7623980.exe
PID 1660 wrote to memory of 1976	1660	Inv_7623980.exe	Inv_7623980.exe
PID 1660 wrote to memory of 1976	1660	Inv_7623980.exe	Inv_7623980.exe
PID 1660 wrote to memory of 1976	1660	Inv_7623980.exe	Inv_7623980.exe
PID 1660 wrote to memory of 1976	1660	Inv_7623980.exe	Inv_7623980.exe
PID 1208 wrote to memory of 1776	1208	Explorer.EXE	cmstp.exe
PID 1208 wrote to memory of 1776	1208	Explorer.EXE	cmstp.exe
PID 1208 wrote to memory of 1776	1208	Explorer.EXE	cmstp.exe
PID 1208 wrote to memory of 1776	1208	Explorer.EXE	cmstp.exe
PID 1208 wrote to memory of 1776	1208	Explorer.EXE	cmstp.exe
PID 1208 wrote to memory of 1776	1208	Explorer.EXE	cmstp.exe
PID 1208 wrote to memory of 1776	1208	Explorer.EXE	cmstp.exe
PID 1776 wrote to memory of 332	1776	cmstp.exe	cmd.exe
PID 1776 wrote to memory of 332	1776	cmstp.exe	cmd.exe
PID 1776 wrote to memory of 332	1776	cmstp.exe	cmd.exe
PID 1776 wrote to memory of 332	1776	cmstp.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1208

C:\Users\Admin\AppData\Local\Temp\27-07-2021\27-07-2021\Inv_7623980.exe
"C:\Users\Admin\AppData\Local\Temp\27-07-2021\27-07-2021\Inv_7623980.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660

C:\Users\Admin\AppData\Local\Temp\27-07-2021\27-07-2021\Inv_7623980.exe
"C:\Users\Admin\AppData\Local\Temp\27-07-2021\27-07-2021\Inv_7623980.exe"
3⤵
PID:1992

C:\Users\Admin\AppData\Local\Temp\27-07-2021\27-07-2021\Inv_7623980.exe
"C:\Users\Admin\AppData\Local\Temp\27-07-2021\27-07-2021\Inv_7623980.exe"
3⤵
PID:1988

C:\Users\Admin\AppData\Local\Temp\27-07-2021\27-07-2021\Inv_7623980.exe
"C:\Users\Admin\AppData\Local\Temp\27-07-2021\27-07-2021\Inv_7623980.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\SysWOW64\cmstp.exe
"C:\Windows\SysWOW64\cmstp.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\27-07-2021\27-07-2021\Inv_7623980.exe"
3⤵
- Deletes itself
PID:332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/332-71-0x0000000000000000-mapping.dmp

Download
memory/1208-68-0x0000000004A50000-0x0000000004B6C000-memory.dmp

Filesize
1.1MB

Download
memory/1208-76-0x00000000096B0000-0x0000000009822000-memory.dmp

Filesize
1.4MB

Download
memory/1660-61-0x0000000004200000-0x000000000427B000-memory.dmp

Filesize
492KB

Download
memory/1660-62-0x00000000041C0000-0x00000000041C1000-memory.dmp

Filesize
4KB

Download
memory/1660-63-0x00000000004B0000-0x00000000004BF000-memory.dmp

Filesize
60KB

Download
memory/1660-59-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1776-72-0x0000000000E80000-0x0000000000E98000-memory.dmp

Filesize
96KB

Download
memory/1776-69-0x0000000000000000-mapping.dmp

Download
memory/1776-70-0x0000000074F31000-0x0000000074F33000-memory.dmp

Filesize
8KB

Download
memory/1776-73-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/1776-74-0x0000000000A80000-0x0000000000D83000-memory.dmp

Filesize
3.0MB

Download
memory/1776-75-0x00000000009E0000-0x0000000000A6F000-memory.dmp

Filesize
572KB

Download
memory/1976-67-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1976-66-0x00000000008B0000-0x0000000000BB3000-memory.dmp

Filesize
3.0MB

Download
memory/1976-65-0x000000000041D0F0-mapping.dmp

Download
memory/1976-64-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download