xloader | e94ab3e9bc6dfb0889e82075cbef674de3c160a8d4bbf9b3d596381bebf492af

Analysis

max time kernel
149s
max time network
135s
platform
windows10_x64
resource
win10-en
submitted
02/09/2021, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Split BL_PL.exe
Size 688KB
Sample210902-catpramees
SHA256 e94ab3e9bc6dfb0889e82075cbef674de3c160a8d4bbf9b3d596381bebf492af
MD5 fdaa7ea645b190b5049db5e11ee65456
SHA1 c96956ef38e91160217379b008b4534d5c7862c6
SHA512 95cb0f1614d065db83e7ac94f9fb3587f02d72118ce2b91e7480eb801b484acca64a388eb1e2c944abdc069698d4e888307c1a2d534bfae1fd903d34a577ef9f
MD5 SHA1 SHA512

Score

10^/10

xloader mej0 loader rat

Malware Config

Extracted

Family

xloader

Version

Campaign

mej0

http://www.lifewithbriana.com/mej0/

Decoy

mtxs8.com
quickskiplondon.com
sltplanner.com
generatedate.com
amsinspections.com
tomrings.com
109friends.com
freelovereading.com
avalapartners.com
nordiqueluxury.com
inmbex.com
everybankatm.com
bo1899.com
ashymeadow.com
pubgm-chickendinner.com
takudolunch.com
carlagremiao.com
actonetheatre.com
wemhealth.com
khasomat.net
lartiqueusa.com
singularity.institute
ashsgx567d.com
sequoiaparts.net
ujriksalead.com
ag99.xyz
isabeltimon.com
bijyo-topic.site
homefuels.energy
2ofakinddesigns.com
iggglobal.com
ravenlightproductions.com
magicaltransform.com
2936vaquero.com
essentialme.network
thebrathouse.info
tecstrong.net
ayulaksmi.com
maximebazerque.com
bankdj.com
pizzaoff.com
eastcohemp.com
acordolimpo.com
mediacpstreamchile.com
wholesalefleuerdelis.com
chuangyuanfz.com
getcenteredwithclay.com
retaboo.com
ikonicboatcharters.com
parakhonskiy.com
tropical-therapy.com
metropitstop.com
municipiodeanton.net
valorplanodesaudemaranhao.info
alibabakanaat.com
creditsoptionsnow.com
arabgerman.digital
webspazio.com
sunsyncindia.com
jlsolutionspty.com
almightyamerican.com
nadirshirts.com
gdxinmu.com
postcaremedical.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/4416-125-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral2/memory/4416-126-0x000000000041D050-mapping.dmp	xloader
behavioral2/memory/4436-133-0x0000000002B60000-0x0000000002B88000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4564 set thread context of 4416	4564	Split BL_PL.exe	79
PID 4416 set thread context of 2708	4416	Split BL_PL.exe	24
PID 4436 set thread context of 2708	4436	cmd.exe	24

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
4416	Split BL_PL.exe
4416	Split BL_PL.exe
4416	Split BL_PL.exe
4416	Split BL_PL.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe
4436	cmd.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4416	Split BL_PL.exe
4416	Split BL_PL.exe
4416	Split BL_PL.exe
4436	cmd.exe
4436	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4416	Split BL_PL.exe
Token: SeDebugPrivilege	4436	cmd.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2708	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4416	4564	Split BL_PL.exe	79
PID 4564 wrote to memory of 4416	4564	Split BL_PL.exe	79
PID 4564 wrote to memory of 4416	4564	Split BL_PL.exe	79
PID 4564 wrote to memory of 4416	4564	Split BL_PL.exe	79
PID 4564 wrote to memory of 4416	4564	Split BL_PL.exe	79
PID 4564 wrote to memory of 4416	4564	Split BL_PL.exe	79
PID 2708 wrote to memory of 4436	2708	Explorer.EXE	87
PID 2708 wrote to memory of 4436	2708	Explorer.EXE	87
PID 2708 wrote to memory of 4436	2708	Explorer.EXE	87
PID 4436 wrote to memory of 2720	4436	cmd.exe	88
PID 4436 wrote to memory of 2720	4436	cmd.exe	88
PID 4436 wrote to memory of 2720	4436	cmd.exe	88

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Users\Admin\AppData\Local\Temp\Split BL_PL.exe
  "C:\Users\Admin\AppData\Local\Temp\Split BL_PL.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Users\Admin\AppData\Local\Temp\Split BL_PL.exe
    "C:\Users\Admin\AppData\Local\Temp\Split BL_PL.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:4328
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:4336
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:4320
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:4308
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:4304
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:4440
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:3712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Split BL_PL.exe"
    3⤵
    PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2708-129-0x0000000008CD0000-0x0000000008E4E000-memory.dmp

Download

memory/2708-136-0x0000000008E50000-0x0000000008F81000-memory.dmp

Download

memory/4416-125-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4416-128-0x0000000000970000-0x0000000000980000-memory.dmp

Download

memory/4416-127-0x0000000000EB0000-0x00000000011D0000-memory.dmp

Download

memory/4436-132-0x0000000000210000-0x0000000000269000-memory.dmp

Download

memory/4436-133-0x0000000002B60000-0x0000000002B88000-memory.dmp

Download

memory/4436-135-0x0000000003220000-0x00000000032AF000-memory.dmp

Download

memory/4436-134-0x0000000002E70000-0x0000000003190000-memory.dmp

Download

memory/4564-121-0x0000000005500000-0x0000000005516000-memory.dmp

Download

memory/4564-119-0x0000000005450000-0x0000000005451000-memory.dmp

Download

memory/4564-122-0x0000000007740000-0x0000000007741000-memory.dmp

Download

memory/4564-118-0x0000000005340000-0x0000000005341000-memory.dmp

Download

memory/4564-120-0x0000000005240000-0x00000000052D2000-memory.dmp

Download

memory/4564-124-0x00000000076F0000-0x000000000771A000-memory.dmp

Download

memory/4564-115-0x00000000009E0000-0x00000000009E1000-memory.dmp

Download

memory/4564-123-0x0000000007060000-0x00000000070BF000-memory.dmp

Download

memory/4564-117-0x0000000005840000-0x0000000005841000-memory.dmp

Download