xloader | b40312b973ddb1ec411375991f52c6d19204e650d90507445782aaa05bc02e46

General

Target

b911af1e5d84afbe42050f97cef3573b.exe
Size

856KB
MD5

b911af1e5d84afbe42050f97cef3573b
SHA1

706a40efe57a6351736054e3758de58573465a95
SHA256

b40312b973ddb1ec411375991f52c6d19204e650d90507445782aaa05bc02e46
SHA512

7effa2081a2e6e04fdee3d4696944a5d2bb80a16e8e2d173c173c80958e4ab69a9a9c52e8bcbb587a358ef6836569e298167acd9b05c4f0cedcdd31b6cdf440d

Score

10^/10

xloader ahdu loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ahdu

C2

http://www.casinoregio.com/ahdu/

Decoy

premiumfreebie.com

spintheblackestcircles.com

okaidoku-shop.net

zonaseguradregistropremios.com

wzocflfow.com

maanyah.com

warrioredjuan.com

uniquelypizza.com

wondertreehr.com

ddriiverzautozs.com

mattenterline.com

urenium.com

salonjedibreakthrough.com

imgkurd.com

pierrejacqueslyon.com

quimicasurandina.com

jkpfukgmt.icu

ansariclinic.com

ashleysema.design

arkadiafoliage.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1384-66-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1384-67-0x000000000041D080-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

b911af1e5d84afbe42050f97cef3573b.exe

description pid process target process

PID 1248 set thread context of 1384 1248 b911af1e5d84afbe42050f97cef3573b.exe b911af1e5d84afbe42050f97cef3573b.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

b911af1e5d84afbe42050f97cef3573b.exe

pid process

1384 b911af1e5d84afbe42050f97cef3573b.exe

description	pid	process	target process
PID 1248 set thread context of 1384	1248	b911af1e5d84afbe42050f97cef3573b.exe	b911af1e5d84afbe42050f97cef3573b.exe

pid	process
1384	b911af1e5d84afbe42050f97cef3573b.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

b911af1e5d84afbe42050f97cef3573b.exe

description	pid	process	target process
PID 1248 wrote to memory of 1384	1248	b911af1e5d84afbe42050f97cef3573b.exe	b911af1e5d84afbe42050f97cef3573b.exe
PID 1248 wrote to memory of 1384	1248	b911af1e5d84afbe42050f97cef3573b.exe	b911af1e5d84afbe42050f97cef3573b.exe
PID 1248 wrote to memory of 1384	1248	b911af1e5d84afbe42050f97cef3573b.exe	b911af1e5d84afbe42050f97cef3573b.exe
PID 1248 wrote to memory of 1384	1248	b911af1e5d84afbe42050f97cef3573b.exe	b911af1e5d84afbe42050f97cef3573b.exe
PID 1248 wrote to memory of 1384	1248	b911af1e5d84afbe42050f97cef3573b.exe	b911af1e5d84afbe42050f97cef3573b.exe
PID 1248 wrote to memory of 1384	1248	b911af1e5d84afbe42050f97cef3573b.exe	b911af1e5d84afbe42050f97cef3573b.exe
PID 1248 wrote to memory of 1384	1248	b911af1e5d84afbe42050f97cef3573b.exe	b911af1e5d84afbe42050f97cef3573b.exe

C:\Users\Admin\AppData\Local\Temp\b911af1e5d84afbe42050f97cef3573b.exe
"C:\Users\Admin\AppData\Local\Temp\b911af1e5d84afbe42050f97cef3573b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1248

C:\Users\Admin\AppData\Local\Temp\b911af1e5d84afbe42050f97cef3573b.exe
"C:\Users\Admin\AppData\Local\Temp\b911af1e5d84afbe42050f97cef3573b.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1384

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1248-60-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/1248-62-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download
memory/1248-63-0x00000000003D0000-0x00000000003E1000-memory.dmp

Filesize
68KB

Download
memory/1248-64-0x00000000058A0000-0x0000000005943000-memory.dmp

Filesize
652KB

Download
memory/1248-65-0x00000000041B0000-0x00000000041E4000-memory.dmp

Filesize
208KB

Download
memory/1384-66-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1384-67-0x000000000041D080-mapping.dmp

Download
memory/1384-68-0x00000000009F0000-0x0000000000CF3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing