xloader | a544b4050677d9e5ad964398954cf7d74c96b65a1126a8bb3491fbe52ff0ec10

Analysis

max time kernel
153s
max time network
153s
platform
windows10_x64
resource
win10v20210408
submitted
27-07-2021 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27-07-2021/27-07-2021/Inv_7623980.exe
Size

957KB
MD5

ac0aafad021d642a83f0e0e00f925160
SHA1

9a225f4936ef458a3371e7681f942b7733d8eb25
SHA256

81cbdffd1b44ca983180456d058b8eaadf51adbd19600dbbde68be7a4ef09a54
SHA512

07683f8a9d789cc6e29a3ece064df8d9ba8e3d083a13c76cfeb669b75ecbfc0108669c3438a67fb9034a5fb98864680b6298d0c5506046f4d3581b08cb1d1504

Score

10^/10

xloader loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.3

http://www.inverservi.com/m6b5/

Decoy

ixtarbelize.com

pheamal.com

daiyncc.com

staydoubted.com

laagerlitigation.club

sukrantastansakarya.com

esupport.ltd

vetscontracting.net

themuslimlife.coach

salmanairs.com

somatictherapyservices.com

lastminuteminister.com

comunicarbuenosaires.com

kazuya.tech

insightlyservicedev.com

redevelopment38subhashnagar.com

thefutureinvestor.com

simplysu.com

lagu45.com

livingstonpistolpermit.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral12/memory/3284-124-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral12/memory/3284-125-0x000000000041D0F0-mapping.dmp	xloader
behavioral12/memory/1172-131-0x0000000000860000-0x0000000000889000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

Processes:

Inv_7623980.exeInv_7623980.execmmon32.exe

description	pid	process	target process
PID 632 set thread context of 3284	632	Inv_7623980.exe	Inv_7623980.exe
PID 3284 set thread context of 2428	3284	Inv_7623980.exe	Explorer.EXE
PID 1172 set thread context of 2428	1172	cmmon32.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

Inv_7623980.execmmon32.exe

pid	process
3284	Inv_7623980.exe
3284	Inv_7623980.exe
3284	Inv_7623980.exe
3284	Inv_7623980.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe
1172	cmmon32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2428 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Inv_7623980.execmmon32.exe

pid process

3284 Inv_7623980.exe
3284 Inv_7623980.exe
3284 Inv_7623980.exe
1172 cmmon32.exe
1172 cmmon32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Inv_7623980.execmmon32.exe

description pid process

Token: SeDebugPrivilege 3284 Inv_7623980.exe
Token: SeDebugPrivilege 1172 cmmon32.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

2428 Explorer.EXE

pid	process
2428	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	3284	Inv_7623980.exe
Token: SeDebugPrivilege	1172	cmmon32.exe

pid	process
2428	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Inv_7623980.exeExplorer.EXEcmmon32.exe

description	pid	process	target process
PID 632 wrote to memory of 3284	632	Inv_7623980.exe	Inv_7623980.exe
PID 632 wrote to memory of 3284	632	Inv_7623980.exe	Inv_7623980.exe
PID 632 wrote to memory of 3284	632	Inv_7623980.exe	Inv_7623980.exe
PID 632 wrote to memory of 3284	632	Inv_7623980.exe	Inv_7623980.exe
PID 632 wrote to memory of 3284	632	Inv_7623980.exe	Inv_7623980.exe
PID 632 wrote to memory of 3284	632	Inv_7623980.exe	Inv_7623980.exe
PID 2428 wrote to memory of 1172	2428	Explorer.EXE	cmmon32.exe
PID 2428 wrote to memory of 1172	2428	Explorer.EXE	cmmon32.exe
PID 2428 wrote to memory of 1172	2428	Explorer.EXE	cmmon32.exe
PID 1172 wrote to memory of 2284	1172	cmmon32.exe	cmd.exe
PID 1172 wrote to memory of 2284	1172	cmmon32.exe	cmd.exe
PID 1172 wrote to memory of 2284	1172	cmmon32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2428

C:\Users\Admin\AppData\Local\Temp\27-07-2021\27-07-2021\Inv_7623980.exe
"C:\Users\Admin\AppData\Local\Temp\27-07-2021\27-07-2021\Inv_7623980.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:632

C:\Users\Admin\AppData\Local\Temp\27-07-2021\27-07-2021\Inv_7623980.exe
"C:\Users\Admin\AppData\Local\Temp\27-07-2021\27-07-2021\Inv_7623980.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3284

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\27-07-2021\27-07-2021\Inv_7623980.exe"
3⤵
PID:2284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/632-114-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/632-116-0x0000000005860000-0x0000000005861000-memory.dmp

Filesize
4KB

Download
memory/632-117-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download
memory/632-118-0x0000000005400000-0x0000000005401000-memory.dmp

Filesize
4KB

Download
memory/632-119-0x0000000005360000-0x0000000005361000-memory.dmp

Filesize
4KB

Download
memory/632-120-0x0000000005360000-0x000000000585E000-memory.dmp

Filesize
5.0MB

Download
memory/632-121-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/632-122-0x0000000005570000-0x00000000055EB000-memory.dmp

Filesize
492KB

Download
memory/632-123-0x0000000005310000-0x000000000531F000-memory.dmp

Filesize
60KB

Download
memory/1172-131-0x0000000000860000-0x0000000000889000-memory.dmp

Filesize
164KB

Download
memory/1172-129-0x0000000000000000-mapping.dmp

Download
memory/1172-130-0x00000000009E0000-0x00000000009EC000-memory.dmp

Filesize
48KB

Download
memory/1172-132-0x0000000004700000-0x0000000004A20000-memory.dmp

Filesize
3.1MB

Download
memory/1172-134-0x0000000004660000-0x00000000046EF000-memory.dmp

Filesize
572KB

Download
memory/2284-133-0x0000000000000000-mapping.dmp

Download
memory/2428-128-0x00000000049F0000-0x0000000004AE2000-memory.dmp

Filesize
968KB

Download
memory/2428-135-0x0000000004AF0000-0x0000000004C1D000-memory.dmp

Filesize
1.2MB

Download
memory/3284-125-0x000000000041D0F0-mapping.dmp

Download
memory/3284-127-0x0000000000FF0000-0x0000000001000000-memory.dmp

Filesize
64KB

Download
memory/3284-126-0x0000000001940000-0x0000000001C60000-memory.dmp

Filesize
3.1MB

Download
memory/3284-124-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download