xloader | e94b8626361ef2ef783dbb4c5662c62a2f27f79e7453b0831805a04541e0ac12

General

Target

ae7b3dc7cbc2202855418718b8cc9c3c.exe
Size

426KB
MD5

ae7b3dc7cbc2202855418718b8cc9c3c
SHA1

cac4bddaa47b50256006da8a4bf2c6bb3528bcc9
SHA256

e94b8626361ef2ef783dbb4c5662c62a2f27f79e7453b0831805a04541e0ac12
SHA512

b95a83e6c0a32b5483aa2eb22116d03b028edb077b8474477689584d4363ed5aca6f2fa4eb2e70698950d0b7260e5d40ee85f21db7f86aba9588e6c4aba9e9f3

Score

10^/10

xloader uytf loader rat

Malware Config

Extracted

Family

xloader

Version

2.4

Campaign

uytf

C2

http://www.fasilitatortoefl.com/uytf/

Decoy

estherestates.online

babyballetwigan.com

ignorantrough.xyz

moominmamalog.com

pasticcerialemmi.com

orangstyle.com

oldwaterfordfarm.com

aiiqiuwnsas.com

youindependents.com

runbank.net

phytolipshine.com

almedmedicalcenter.com

czxzsa.com

yummyblockparty.com

gadgetinfo.info

cloudfolderplayer.com

chowding.com

xn--tarzmbu-ufb.com

danielaasab.com

dreampropertiesluxury.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4592-125-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/4592-126-0x000000000041D520-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

ae7b3dc7cbc2202855418718b8cc9c3c.exe

description pid process target process

PID 4476 set thread context of 4592 4476 ae7b3dc7cbc2202855418718b8cc9c3c.exe ae7b3dc7cbc2202855418718b8cc9c3c.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ae7b3dc7cbc2202855418718b8cc9c3c.exe

pid process

4592 ae7b3dc7cbc2202855418718b8cc9c3c.exe
4592 ae7b3dc7cbc2202855418718b8cc9c3c.exe

description	pid	process	target process
PID 4476 set thread context of 4592	4476	ae7b3dc7cbc2202855418718b8cc9c3c.exe	ae7b3dc7cbc2202855418718b8cc9c3c.exe

pid	process
4592	ae7b3dc7cbc2202855418718b8cc9c3c.exe
4592	ae7b3dc7cbc2202855418718b8cc9c3c.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ae7b3dc7cbc2202855418718b8cc9c3c.exe

description	pid	process	target process
PID 4476 wrote to memory of 4592	4476	ae7b3dc7cbc2202855418718b8cc9c3c.exe	ae7b3dc7cbc2202855418718b8cc9c3c.exe
PID 4476 wrote to memory of 4592	4476	ae7b3dc7cbc2202855418718b8cc9c3c.exe	ae7b3dc7cbc2202855418718b8cc9c3c.exe
PID 4476 wrote to memory of 4592	4476	ae7b3dc7cbc2202855418718b8cc9c3c.exe	ae7b3dc7cbc2202855418718b8cc9c3c.exe
PID 4476 wrote to memory of 4592	4476	ae7b3dc7cbc2202855418718b8cc9c3c.exe	ae7b3dc7cbc2202855418718b8cc9c3c.exe
PID 4476 wrote to memory of 4592	4476	ae7b3dc7cbc2202855418718b8cc9c3c.exe	ae7b3dc7cbc2202855418718b8cc9c3c.exe
PID 4476 wrote to memory of 4592	4476	ae7b3dc7cbc2202855418718b8cc9c3c.exe	ae7b3dc7cbc2202855418718b8cc9c3c.exe

C:\Users\Admin\AppData\Local\Temp\ae7b3dc7cbc2202855418718b8cc9c3c.exe
"C:\Users\Admin\AppData\Local\Temp\ae7b3dc7cbc2202855418718b8cc9c3c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4476

C:\Users\Admin\AppData\Local\Temp\ae7b3dc7cbc2202855418718b8cc9c3c.exe
"C:\Users\Admin\AppData\Local\Temp\ae7b3dc7cbc2202855418718b8cc9c3c.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4592

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4476-115-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/4476-117-0x0000000005C80000-0x0000000005C81000-memory.dmp

Filesize
4KB

Download
memory/4476-118-0x0000000005820000-0x0000000005821000-memory.dmp

Filesize
4KB

Download
memory/4476-119-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/4476-120-0x00000000058E0000-0x00000000058E7000-memory.dmp

Filesize
28KB

Download
memory/4476-121-0x0000000005AE0000-0x0000000005AE1000-memory.dmp

Filesize
4KB

Download
memory/4476-122-0x0000000005780000-0x0000000005C7E000-memory.dmp

Filesize
5.0MB

Download
memory/4476-123-0x00000000064B0000-0x0000000006510000-memory.dmp

Filesize
384KB

Download
memory/4476-124-0x00000000089E0000-0x0000000008A0B000-memory.dmp

Filesize
172KB

Download
memory/4592-125-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4592-126-0x000000000041D520-mapping.dmp

Download
memory/4592-127-0x0000000001800000-0x0000000001B20000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing