xloader | a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564

General

Target

a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe
Size

430KB
MD5

866d1aeb69daac5e6e4dda938edf8d26
SHA1

184f3ae0508d5004a9e3fe981cbc830092d41ed7
SHA256

a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564
SHA512

e488ee1b612c683c72c9ce7d33727d1f6daa6f1bdb599b9f77fd2cf6f0b7122d650a4347bfb836bf4b5e111c92057ecfb91fd517821c32cf7b1fc246ec8bfcee

Score

10^/10

xloader b6a4 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

b6a4

C2

http://www.helpmovingandstorage.com/b6a4/

Decoy

gr2future.com

asteroid.finance

skoba-plast.com

rnerfrfw5z3ki.net

thesmartroadtoretirement.com

avisdrummondhomes.com

banban365.net

profesyonelkampcadiri.net

royalloanhs.com

yulujy.com

xn--naqejahan-n3b.com

msalee.net

dollyvee.com

albertagamehawkersclub.com

cbspecialists.com

findingforeverrealty.com

mrtireshop.com

wadamasanari.com

growtechinfo.com

qipai039.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3932-117-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe

description	pid	process	target process
PID 2664 set thread context of 3932	2664	a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe	a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe

pid	process
3932	a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe
3932	a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe

pid process

2664 a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe

pid	process
2664	a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe

description	pid	process	target process
PID 2664 wrote to memory of 3932	2664	a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe	a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe
PID 2664 wrote to memory of 3932	2664	a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe	a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe
PID 2664 wrote to memory of 3932	2664	a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe	a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe
PID 2664 wrote to memory of 3932	2664	a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe	a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe

C:\Users\Admin\AppData\Local\Temp\a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe
"C:\Users\Admin\AppData\Local\Temp\a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2664

C:\Users\Admin\AppData\Local\Temp\a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe
"C:\Users\Admin\AppData\Local\Temp\a41ba93183d03c4cf6b138170fab1d15c306918bb4acd1c2cbc3ee53765e5564.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3932

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2664-116-0x00000000009B0000-0x00000000009B2000-memory.dmp

Filesize
8KB

Download
memory/3932-115-0x000000000041D0B0-mapping.dmp

Download
memory/3932-117-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3932-118-0x0000000001740000-0x0000000001A60000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads