xloader | 6db6324fe282260a224e77fff9bdad3240a63d48ac587f2a701785ea69c317a5

General

Target

Order_15078.exe
Size

685KB
MD5

c50b491461d89171d660abcc9c654171
SHA1

e1cc6e9512546b2a8eefd3741f52c30121be3dea
SHA256

6db6324fe282260a224e77fff9bdad3240a63d48ac587f2a701785ea69c317a5
SHA512

7589ece7798fa6affec99655d301cb23acd8a25654c0411ad6e871247a24b31653ea8b6249b6440124acb5fad5f390f73e8cbb7ee76be1970ee12f4ad27e52e0

Score

10^/10

xloader loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.steveblexrud.com/rqe8/

Decoy

bjft.net

abrosnm3.com

badlistens.com

signal-japan.com

schaka.com

kingdompersonalbranding.com

sewmenship.com

lzproperty.com

mojoimpacthosting.com

carinsurancecoverage.care

corporatemercadona.com

mobileswash.com

forevercelebration2026.com

co-het.com

bellesherlou.com

commentsoldgolf.com

onlytwod.group

utesco.info

martstrip.com

onszdgu.icu

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral2/memory/4016-121-0x0000000004AD0000-0x0000000004ADB000-memory.dmp	CustAttr

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3972-124-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral2/memory/3972-125-0x000000000041CFE0-mapping.dmp	xloader
behavioral2/memory/3148-132-0x0000000003000000-0x0000000003028000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

Processes:

Order_15078.exeOrder_15078.execscript.exe

description	pid	process	target process
PID 4016 set thread context of 3972	4016	Order_15078.exe	Order_15078.exe
PID 3972 set thread context of 3028	3972	Order_15078.exe	Explorer.EXE
PID 3148 set thread context of 3028	3148	cscript.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

Order_15078.execscript.exe

pid	process
3972	Order_15078.exe
3972	Order_15078.exe
3972	Order_15078.exe
3972	Order_15078.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe
3148	cscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3028 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Order_15078.execscript.exe

pid process

3972 Order_15078.exe
3972 Order_15078.exe
3972 Order_15078.exe
3148 cscript.exe
3148 cscript.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Order_15078.execscript.exe

description pid process

Token: SeDebugPrivilege 3972 Order_15078.exe
Token: SeDebugPrivilege 3148 cscript.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3028 Explorer.EXE

pid	process
3028	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	3972	Order_15078.exe
Token: SeDebugPrivilege	3148	cscript.exe

pid	process
3028	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Order_15078.exeExplorer.EXEcscript.exe

description	pid	process	target process
PID 4016 wrote to memory of 3972	4016	Order_15078.exe	Order_15078.exe
PID 4016 wrote to memory of 3972	4016	Order_15078.exe	Order_15078.exe
PID 4016 wrote to memory of 3972	4016	Order_15078.exe	Order_15078.exe
PID 4016 wrote to memory of 3972	4016	Order_15078.exe	Order_15078.exe
PID 4016 wrote to memory of 3972	4016	Order_15078.exe	Order_15078.exe
PID 4016 wrote to memory of 3972	4016	Order_15078.exe	Order_15078.exe
PID 3028 wrote to memory of 3148	3028	Explorer.EXE	cscript.exe
PID 3028 wrote to memory of 3148	3028	Explorer.EXE	cscript.exe
PID 3028 wrote to memory of 3148	3028	Explorer.EXE	cscript.exe
PID 3148 wrote to memory of 1192	3148	cscript.exe	cmd.exe
PID 3148 wrote to memory of 1192	3148	cscript.exe	cmd.exe
PID 3148 wrote to memory of 1192	3148	cscript.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3028

C:\Users\Admin\AppData\Local\Temp\Order_15078.exe
"C:\Users\Admin\AppData\Local\Temp\Order_15078.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4016

C:\Users\Admin\AppData\Local\Temp\Order_15078.exe
"C:\Users\Admin\AppData\Local\Temp\Order_15078.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Order_15078.exe"
3⤵
PID:1192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-130-0x0000000000000000-mapping.dmp

Download
memory/3028-128-0x00000000071C0000-0x00000000072F9000-memory.dmp

Filesize
1.2MB

Download
memory/3028-135-0x0000000006E30000-0x0000000006EC5000-memory.dmp

Filesize
596KB

Download
memory/3148-134-0x0000000004A60000-0x0000000004AEF000-memory.dmp

Filesize
572KB

Download
memory/3148-131-0x0000000000160000-0x0000000000187000-memory.dmp

Filesize
156KB

Download
memory/3148-133-0x00000000046B0000-0x00000000049D0000-memory.dmp

Filesize
3.1MB

Download
memory/3148-132-0x0000000003000000-0x0000000003028000-memory.dmp

Filesize
160KB

Download
memory/3148-129-0x0000000000000000-mapping.dmp

Download
memory/3972-125-0x000000000041CFE0-mapping.dmp

Download
memory/3972-124-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3972-127-0x0000000000FF0000-0x0000000001000000-memory.dmp

Filesize
64KB

Download
memory/3972-126-0x0000000001940000-0x0000000001C60000-memory.dmp

Filesize
3.1MB

Download
memory/4016-114-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/4016-123-0x00000000072D0000-0x00000000072FF000-memory.dmp

Filesize
188KB

Download
memory/4016-122-0x0000000007240000-0x00000000072B2000-memory.dmp

Filesize
456KB

Download
memory/4016-121-0x0000000004AD0000-0x0000000004ADB000-memory.dmp

Filesize
44KB

Download
memory/4016-120-0x0000000004FB0000-0x0000000005042000-memory.dmp

Filesize
584KB

Download
memory/4016-119-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/4016-118-0x0000000005140000-0x0000000005141000-memory.dmp

Filesize
4KB

Download
memory/4016-117-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/4016-116-0x0000000005640000-0x0000000005641000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads