xloader | 06db28157cbf8afaef9fada2db963f0a1f81a266512c748dc6ea86d371036900

General

Target

2a69371ccb46bbc07aebe99359fd69b9.exe
Size

477KB
MD5

2a69371ccb46bbc07aebe99359fd69b9
SHA1

8be1b2e74bb857b130222bf2604fa79952792034
SHA256

06db28157cbf8afaef9fada2db963f0a1f81a266512c748dc6ea86d371036900
SHA512

fd8089141d3a926e197c3aee2ed4b44798591b0311a5973de3eafc88c1837d9620c413a873c27c579ce133f299926026938601b0784dd50588ca02cf123835af

Score

10^/10

xloader uytf loader rat

Malware Config

Extracted

Family

xloader

Version

2.4

Campaign

uytf

C2

http://www.fasilitatortoefl.com/uytf/

Decoy

estherestates.online

babyballetwigan.com

ignorantrough.xyz

moominmamalog.com

pasticcerialemmi.com

orangstyle.com

oldwaterfordfarm.com

aiiqiuwnsas.com

youindependents.com

runbank.net

phytolipshine.com

almedmedicalcenter.com

czxzsa.com

yummyblockparty.com

gadgetinfo.info

cloudfolderplayer.com

chowding.com

xn--tarzmbu-ufb.com

danielaasab.com

dreampropertiesluxury.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1936-66-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1936-67-0x000000000041D520-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

2a69371ccb46bbc07aebe99359fd69b9.exe

description pid process target process

PID 1736 set thread context of 1936 1736 2a69371ccb46bbc07aebe99359fd69b9.exe 2a69371ccb46bbc07aebe99359fd69b9.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2a69371ccb46bbc07aebe99359fd69b9.exe

pid process

1936 2a69371ccb46bbc07aebe99359fd69b9.exe

description	pid	process	target process
PID 1736 set thread context of 1936	1736	2a69371ccb46bbc07aebe99359fd69b9.exe	2a69371ccb46bbc07aebe99359fd69b9.exe

pid	process
1936	2a69371ccb46bbc07aebe99359fd69b9.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

2a69371ccb46bbc07aebe99359fd69b9.exe

description	pid	process	target process
PID 1736 wrote to memory of 1936	1736	2a69371ccb46bbc07aebe99359fd69b9.exe	2a69371ccb46bbc07aebe99359fd69b9.exe
PID 1736 wrote to memory of 1936	1736	2a69371ccb46bbc07aebe99359fd69b9.exe	2a69371ccb46bbc07aebe99359fd69b9.exe
PID 1736 wrote to memory of 1936	1736	2a69371ccb46bbc07aebe99359fd69b9.exe	2a69371ccb46bbc07aebe99359fd69b9.exe
PID 1736 wrote to memory of 1936	1736	2a69371ccb46bbc07aebe99359fd69b9.exe	2a69371ccb46bbc07aebe99359fd69b9.exe
PID 1736 wrote to memory of 1936	1736	2a69371ccb46bbc07aebe99359fd69b9.exe	2a69371ccb46bbc07aebe99359fd69b9.exe
PID 1736 wrote to memory of 1936	1736	2a69371ccb46bbc07aebe99359fd69b9.exe	2a69371ccb46bbc07aebe99359fd69b9.exe
PID 1736 wrote to memory of 1936	1736	2a69371ccb46bbc07aebe99359fd69b9.exe	2a69371ccb46bbc07aebe99359fd69b9.exe

C:\Users\Admin\AppData\Local\Temp\2a69371ccb46bbc07aebe99359fd69b9.exe
"C:\Users\Admin\AppData\Local\Temp\2a69371ccb46bbc07aebe99359fd69b9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1736

C:\Users\Admin\AppData\Local\Temp\2a69371ccb46bbc07aebe99359fd69b9.exe
"C:\Users\Admin\AppData\Local\Temp\2a69371ccb46bbc07aebe99359fd69b9.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1936

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-60-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/1736-62-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download
memory/1736-63-0x00000000005D0000-0x00000000005D7000-memory.dmp

Filesize
28KB

Download
memory/1736-64-0x0000000004B90000-0x0000000004BF0000-memory.dmp

Filesize
384KB

Download
memory/1736-65-0x0000000004C00000-0x0000000004C2B000-memory.dmp

Filesize
172KB

Download
memory/1936-66-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1936-67-0x000000000041D520-mapping.dmp

Download
memory/1936-68-0x0000000000C70000-0x0000000000F73000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing