xloader | 8b5e45762b7ac4c0d1df861b21bae63c13f9f580668910c94f310079306acd7b

General

Target

45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
Size

646KB
MD5

e9c787ebeebf1396c2fe4ccb57cbaed2
SHA1

9f88c2ee156e4757543dc5fed8f5d15388ff8548
SHA256

45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363
SHA512

942cc1021d033da4f3901bad8bd2e4c5c904367ed6b5a375e275e0385eae24f7036082b1636decb1da3a3af0d0f3152c142605bbc3e08c311ceb0527b61b0b55

Score

10^/10

xloader tr7h loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

tr7h

C2

http://www.globalinterchangellc.com/tr7h/

Decoy

hnhstudios.com

du-lang.com

lonestartradeoilllc.com

criptool.online

rebus-automotive.com

boxedwallconsepts.net

helixarray.com

jinqiaodianfen.com

goldenwaxi.com

comprarloterianacional.com

digebitdigital.com

cryptoupp.com

332151.com

bousui.club

redakassoumeh.com

giantinosglobalreachstore.com

resultsnft.com

papicolar.com

juvesti.com

tax-kaikei.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1860-67-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1860-68-0x000000000041D4C0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

description	pid	process	target process
PID 1648 set thread context of 1860	1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

pid	process
1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
1860	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

description pid process

Token: SeDebugPrivilege 1648 45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

description	pid	process
Token: SeDebugPrivilege	1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
"C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648

C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
"C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe"
2⤵
PID:1832

C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
"C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe"
2⤵
PID:1844

C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
"C:\Users\Admin\AppData\Local\Temp\45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1860

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-60-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1648-62-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download
memory/1648-63-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/1648-64-0x00000000003D0000-0x00000000003ED000-memory.dmp

Filesize
116KB

Download
memory/1648-65-0x0000000005330000-0x0000000005397000-memory.dmp

Filesize
412KB

Download
memory/1648-66-0x0000000000BE0000-0x0000000000C18000-memory.dmp

Filesize
224KB

Download
memory/1860-67-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1860-68-0x000000000041D4C0-mapping.dmp

Download
memory/1860-69-0x0000000000930000-0x0000000000C33000-memory.dmp

Filesize
3.0MB

Download

description	pid	process	target process
PID 1648 wrote to memory of 1832	1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 1648 wrote to memory of 1832	1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 1648 wrote to memory of 1832	1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 1648 wrote to memory of 1832	1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 1648 wrote to memory of 1844	1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 1648 wrote to memory of 1844	1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 1648 wrote to memory of 1844	1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 1648 wrote to memory of 1844	1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 1648 wrote to memory of 1860	1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 1648 wrote to memory of 1860	1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 1648 wrote to memory of 1860	1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 1648 wrote to memory of 1860	1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 1648 wrote to memory of 1860	1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 1648 wrote to memory of 1860	1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe
PID 1648 wrote to memory of 1860	1648	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe	45e4621118dc78b668c79ca4c7918f4fc09b3d419069d9341c10e03f2e4d3363.exe

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads