xloader | a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c

General

Target

a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
Size

821KB
MD5

6e1476a40e4f1b65294f5ff5df9f99d7
SHA1

da3f2a6fb40d243ece92534253c79c2669bd4e69
SHA256

a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c
SHA512

0bfabd3b94785ddc530ba7b76258382f1212587c50f89da273294e6c698792c4d9296bd323d3814ae559cda1fd3ce3339d9a8e0f168e5e714fc9f804b0ddfc0f

Score

10^/10

xloader euzn loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euzn

C2

http://www.heser.net/euzn/

Decoy

235296tyc.com

gold12guide.art

baibuaherb.com

weberwines.tax

chezvitoria.com

aidenb.tech

pitchdeckservice.com

surgeryforfdf.xyz

workunvaccinated.com

hrtaro.com

yourotcs.com

sonimultispecialityclinic.com

consultantadvisors.com

pentesting-consulting.com

dantechs.digital

longshifa.online

taweilai.net

imyusuke.com

cashndashfinancial.com

fasiglimt.quest

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2928-125-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2928-126-0x000000000041D420-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe

description	pid	process	target process
PID 3260 set thread context of 2928	3260	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe

Modifies registry class 9 IoCs

Processes:

a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\GMKAssembler.Project\Shell\open\command	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\GMKAssembler.Project	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\GMKAssembler.Project\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe\" \"%1\""	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\.gmkasm	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\.gmkasm\ = "GMKAssembler.Project"	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\GMKAssembler.Project\DefaultIcon	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\GMKAssembler.Project\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe"	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\GMKAssembler.Project\Shell	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\GMKAssembler.Project\Shell\open	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exea243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe

pid	process
3260	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
3260	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
2928	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
2928	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe

description pid process

Token: SeDebugPrivilege 3260 a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe

description	pid	process
Token: SeDebugPrivilege	3260	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe

description	pid	process	target process
PID 3260 wrote to memory of 2920	3260	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
PID 3260 wrote to memory of 2920	3260	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
PID 3260 wrote to memory of 2920	3260	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
PID 3260 wrote to memory of 2928	3260	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
PID 3260 wrote to memory of 2928	3260	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
PID 3260 wrote to memory of 2928	3260	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
PID 3260 wrote to memory of 2928	3260	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
PID 3260 wrote to memory of 2928	3260	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
PID 3260 wrote to memory of 2928	3260	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe	a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe

C:\Users\Admin\AppData\Local\Temp\a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
"C:\Users\Admin\AppData\Local\Temp\a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260

C:\Users\Admin\AppData\Local\Temp\a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
"C:\Users\Admin\AppData\Local\Temp\a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe"
2⤵
PID:2920

C:\Users\Admin\AppData\Local\Temp\a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe
"C:\Users\Admin\AppData\Local\Temp\a243b394a1a3377b3ae936e6ea896588cca8cc43f8b961bdecbbe324e28c283c.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2928

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2928-125-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2928-127-0x00000000014A0000-0x00000000017C0000-memory.dmp

Filesize
3.1MB

Download
memory/2928-126-0x000000000041D420-mapping.dmp

Download
memory/3260-121-0x0000000005DA0000-0x0000000005DBD000-memory.dmp

Filesize
116KB

Download
memory/3260-119-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/3260-120-0x00000000059E0000-0x00000000059E1000-memory.dmp

Filesize
4KB

Download
memory/3260-114-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/3260-122-0x0000000007880000-0x0000000007881000-memory.dmp

Filesize
4KB

Download
memory/3260-123-0x0000000007AC0000-0x0000000007B27000-memory.dmp

Filesize
412KB

Download
memory/3260-124-0x0000000007BC0000-0x0000000007BF7000-memory.dmp

Filesize
220KB

Download
memory/3260-118-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download
memory/3260-117-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/3260-116-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads