xloader | 8b5e45762b7ac4c0d1df861b21bae63c13f9f580668910c94f310079306acd7b

General

Target

45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
Size

646KB
MD5

e9c787ebeebf1396c2fe4ccb57cbaed2
SHA1

9f88c2ee156e4757543dc5fed8f5d15388ff8548
SHA256

45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363
SHA512

942cc1021d033da4f3901bad8bd2e4c5c904367ed6b5a375e275e0385eae24f7036082b1636decb1da3a3af0d0f3152c142605bbc3e08c311ceb0527b61b0b55

Score

10^/10

xloader tr7h loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

tr7h

C2

http://www.globalinterchangellc.com/tr7h/

Decoy

hnhstudios.com

du-lang.com

lonestartradeoilllc.com

criptool.online

rebus-automotive.com

boxedwallconsepts.net

helixarray.com

jinqiaodianfen.com

goldenwaxi.com

comprarloterianacional.com

digebitdigital.com

cryptoupp.com

332151.com

bousui.club

redakassoumeh.com

giantinosglobalreachstore.com

resultsnft.com

papicolar.com

juvesti.com

tax-kaikei.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3144-124-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/3144-125-0x000000000041D4C0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

description	pid	process	target process
PID 568 set thread context of 3144	568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

pid	process
568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
3144	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
3144	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

description pid process

Token: SeDebugPrivilege 568 45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

description	pid	process
Token: SeDebugPrivilege	568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

description	pid	process	target process
PID 568 wrote to memory of 776	568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 568 wrote to memory of 776	568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 568 wrote to memory of 776	568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 568 wrote to memory of 2184	568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 568 wrote to memory of 2184	568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 568 wrote to memory of 2184	568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 568 wrote to memory of 3144	568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 568 wrote to memory of 3144	568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 568 wrote to memory of 3144	568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 568 wrote to memory of 3144	568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 568 wrote to memory of 3144	568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 568 wrote to memory of 3144	568	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
"C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568

C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
"C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe"
2⤵
PID:776

C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
"C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe"
2⤵
PID:2184

C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
"C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-114-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/568-116-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download
memory/568-117-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/568-118-0x0000000004DE0000-0x00000000052DE000-memory.dmp

Filesize
5.0MB

Download
memory/568-119-0x0000000004D30000-0x0000000004D31000-memory.dmp

Filesize
4KB

Download
memory/568-120-0x0000000004D40000-0x0000000004D5D000-memory.dmp

Filesize
116KB

Download
memory/568-121-0x0000000006980000-0x0000000006981000-memory.dmp

Filesize
4KB

Download
memory/568-122-0x0000000006C90000-0x0000000006CF7000-memory.dmp

Filesize
412KB

Download
memory/568-123-0x0000000006D00000-0x0000000006D38000-memory.dmp

Filesize
224KB

Download
memory/3144-124-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3144-125-0x000000000041D4C0-mapping.dmp

Download
memory/3144-126-0x0000000001890000-0x0000000001BB0000-memory.dmp

Filesize
3.1MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads