xloader | d064e13de302104e85c1fbc8b177bc3b17ecf1dc0063ff1865d825b219d9f11d

General

Target

TT Transmitted Copy ETT1037468..exe
Size

878KB
MD5

1dc4a1aa19afef7c048a09bd00153ae9
SHA1

cfeac51f7427a964ece4c8faac0e028d31e4b7ea
SHA256

d064e13de302104e85c1fbc8b177bc3b17ecf1dc0063ff1865d825b219d9f11d
SHA512

fb6d0157dea7fb9b2c2a7fc0419d02ad6aaee1c681dd2d99c4fa3d1c46f7b33f78a3bbffa144ac7bcf6b2d12db84a6ab839d336d46e092e7ead94061d9a39408

Score

10^/10

xloader loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.desarrollosolucionesnavarro.com/ipa8/

Decoy

royalposhpups.com

univa.world

lanerbo.com

shopbabygo.com

theutahhomestore.com

serialmixer.icu

linfeiya.com

xn--12cg3de5c2eb5cyi.com

am-conseil-communication.com

dailygame168.com

therightmilitia.com

visions-agency.com

mapopi.com

frugallyketo.com

guapandglo.com

54w-x126v.net

your-health-kick.com

blockchainhub360.com

registernowhd.xyz

votekellykitashima.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/368-67-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/368-68-0x000000000041D0D0-mapping.dmp	xloader
behavioral1/memory/844-74-0x0000000000090000-0x00000000000B9000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1108 cmd.exe

pid	process
1108	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

TT Transmitted Copy ETT1037468..exeTT Transmitted Copy ETT1037468..exewuapp.exe

description	pid	process	target process
PID 1668 set thread context of 368	1668	TT Transmitted Copy ETT1037468..exe	TT Transmitted Copy ETT1037468..exe
PID 368 set thread context of 1248	368	TT Transmitted Copy ETT1037468..exe	Explorer.EXE
PID 844 set thread context of 1248	844	wuapp.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

TT Transmitted Copy ETT1037468..exewuapp.exe

pid	process
368	TT Transmitted Copy ETT1037468..exe
368	TT Transmitted Copy ETT1037468..exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe
844	wuapp.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

TT Transmitted Copy ETT1037468..exewuapp.exe

pid process

368 TT Transmitted Copy ETT1037468..exe
368 TT Transmitted Copy ETT1037468..exe
368 TT Transmitted Copy ETT1037468..exe
844 wuapp.exe
844 wuapp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

TT Transmitted Copy ETT1037468..exewuapp.exe

description pid process

Token: SeDebugPrivilege 368 TT Transmitted Copy ETT1037468..exe
Token: SeDebugPrivilege 844 wuapp.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1248 Explorer.EXE
1248 Explorer.EXE
1248 Explorer.EXE
1248 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1248 Explorer.EXE
1248 Explorer.EXE
1248 Explorer.EXE
1248 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	368	TT Transmitted Copy ETT1037468..exe
Token: SeDebugPrivilege	844	wuapp.exe

pid	process
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE

pid	process
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE
1248	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

TT Transmitted Copy ETT1037468..exeExplorer.EXEwuapp.exe

description	pid	process	target process
PID 1668 wrote to memory of 368	1668	TT Transmitted Copy ETT1037468..exe	TT Transmitted Copy ETT1037468..exe
PID 1668 wrote to memory of 368	1668	TT Transmitted Copy ETT1037468..exe	TT Transmitted Copy ETT1037468..exe
PID 1668 wrote to memory of 368	1668	TT Transmitted Copy ETT1037468..exe	TT Transmitted Copy ETT1037468..exe
PID 1668 wrote to memory of 368	1668	TT Transmitted Copy ETT1037468..exe	TT Transmitted Copy ETT1037468..exe
PID 1668 wrote to memory of 368	1668	TT Transmitted Copy ETT1037468..exe	TT Transmitted Copy ETT1037468..exe
PID 1668 wrote to memory of 368	1668	TT Transmitted Copy ETT1037468..exe	TT Transmitted Copy ETT1037468..exe
PID 1668 wrote to memory of 368	1668	TT Transmitted Copy ETT1037468..exe	TT Transmitted Copy ETT1037468..exe
PID 1248 wrote to memory of 844	1248	Explorer.EXE	wuapp.exe
PID 1248 wrote to memory of 844	1248	Explorer.EXE	wuapp.exe
PID 1248 wrote to memory of 844	1248	Explorer.EXE	wuapp.exe
PID 1248 wrote to memory of 844	1248	Explorer.EXE	wuapp.exe
PID 1248 wrote to memory of 844	1248	Explorer.EXE	wuapp.exe
PID 1248 wrote to memory of 844	1248	Explorer.EXE	wuapp.exe
PID 1248 wrote to memory of 844	1248	Explorer.EXE	wuapp.exe
PID 844 wrote to memory of 1108	844	wuapp.exe	cmd.exe
PID 844 wrote to memory of 1108	844	wuapp.exe	cmd.exe
PID 844 wrote to memory of 1108	844	wuapp.exe	cmd.exe
PID 844 wrote to memory of 1108	844	wuapp.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248

C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy ETT1037468..exe
"C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy ETT1037468..exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy ETT1037468..exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:368

C:\Windows\SysWOW64\wuapp.exe
"C:\Windows\SysWOW64\wuapp.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy ETT1037468..exe"
3⤵
- Deletes itself
PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/368-67-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/368-68-0x000000000041D0D0-mapping.dmp

Download
memory/368-70-0x0000000000120000-0x0000000000130000-memory.dmp

Filesize
64KB

Download
memory/368-69-0x0000000000910000-0x0000000000C13000-memory.dmp

Filesize
3.0MB

Download
memory/844-72-0x0000000000000000-mapping.dmp

Download
memory/844-79-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/844-77-0x0000000001DC0000-0x0000000001E4F000-memory.dmp

Filesize
572KB

Download
memory/844-75-0x0000000001FB0000-0x00000000022B3000-memory.dmp

Filesize
3.0MB

Download
memory/844-74-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/844-73-0x00000000002B0000-0x00000000002BB000-memory.dmp

Filesize
44KB

Download
memory/1108-76-0x0000000000000000-mapping.dmp

Download
memory/1248-71-0x0000000005FF0000-0x00000000060DB000-memory.dmp

Filesize
940KB

Download
memory/1248-78-0x0000000003BF0000-0x0000000003CBD000-memory.dmp

Filesize
820KB

Download
memory/1668-60-0x0000000001160000-0x0000000001161000-memory.dmp

Filesize
4KB

Download
memory/1668-66-0x0000000000B70000-0x0000000000B9A000-memory.dmp

Filesize
168KB

Download
memory/1668-65-0x0000000005E50000-0x0000000005EC7000-memory.dmp

Filesize
476KB

Download
memory/1668-64-0x00000000005F0000-0x00000000005F2000-memory.dmp

Filesize
8KB

Download
memory/1668-63-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/1668-62-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads