xloader | 83242a0f42be34e66e502e4a3a45d2470f3b24aef8a1d8484711f4439d7fe74a

General

Target

4c70d5b1c63a468f7e0aedf64f93ca42.exe
Size

1024KB
MD5

4c70d5b1c63a468f7e0aedf64f93ca42
SHA1

c248ab00560786b7be23151597d9503a2e84602f
SHA256

83242a0f42be34e66e502e4a3a45d2470f3b24aef8a1d8484711f4439d7fe74a
SHA512

2146f98b4f950555333a00668ab6f71ad2a432b12d12cb0c07cc2dc342884f88b491442c84da763b3101ee7ac89e8c08f6552203ba9470401e934191e4858a8c

Score

10^/10

xloader mjyv loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mjyv

C2

http://www.simpeltattofor.men/mjyv/

Decoy

wenyuexuan.com

tropicaldepression.info

healthylifefit.com

reemletenleafy.com

jmrrve.com

mabduh.com

esomvw.com

selfcaresereneneness.com

murdabudz.com

meinemail.online

brandqrcodes.com

live-in-pflege.com

nickrecovery.com

ziototoristorante.com

chatcure.com

corlora.com

localagentlab.com

yogo7.net

krveop.com

heianswer.xyz

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2032-58-0x000000000041D460-mapping.dmp	xloader
behavioral1/memory/2032-59-0x0000000000070000-0x0000000000099000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

4c70d5b1c63a468f7e0aedf64f93ca42.exe

description pid process target process

PID 1768 set thread context of 2032 1768 4c70d5b1c63a468f7e0aedf64f93ca42.exe 4c70d5b1c63a468f7e0aedf64f93ca42.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4c70d5b1c63a468f7e0aedf64f93ca42.exe

pid process

2032 4c70d5b1c63a468f7e0aedf64f93ca42.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4c70d5b1c63a468f7e0aedf64f93ca42.exe

description pid process

Token: SeDebugPrivilege 1768 4c70d5b1c63a468f7e0aedf64f93ca42.exe

description	pid	process	target process
PID 1768 set thread context of 2032	1768	4c70d5b1c63a468f7e0aedf64f93ca42.exe	4c70d5b1c63a468f7e0aedf64f93ca42.exe

pid	process
2032	4c70d5b1c63a468f7e0aedf64f93ca42.exe

description	pid	process
Token: SeDebugPrivilege	1768	4c70d5b1c63a468f7e0aedf64f93ca42.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

4c70d5b1c63a468f7e0aedf64f93ca42.exe

description	pid	process	target process
PID 1768 wrote to memory of 2032	1768	4c70d5b1c63a468f7e0aedf64f93ca42.exe	4c70d5b1c63a468f7e0aedf64f93ca42.exe
PID 1768 wrote to memory of 2032	1768	4c70d5b1c63a468f7e0aedf64f93ca42.exe	4c70d5b1c63a468f7e0aedf64f93ca42.exe
PID 1768 wrote to memory of 2032	1768	4c70d5b1c63a468f7e0aedf64f93ca42.exe	4c70d5b1c63a468f7e0aedf64f93ca42.exe
PID 1768 wrote to memory of 2032	1768	4c70d5b1c63a468f7e0aedf64f93ca42.exe	4c70d5b1c63a468f7e0aedf64f93ca42.exe
PID 1768 wrote to memory of 2032	1768	4c70d5b1c63a468f7e0aedf64f93ca42.exe	4c70d5b1c63a468f7e0aedf64f93ca42.exe
PID 1768 wrote to memory of 2032	1768	4c70d5b1c63a468f7e0aedf64f93ca42.exe	4c70d5b1c63a468f7e0aedf64f93ca42.exe
PID 1768 wrote to memory of 2032	1768	4c70d5b1c63a468f7e0aedf64f93ca42.exe	4c70d5b1c63a468f7e0aedf64f93ca42.exe

C:\Users\Admin\AppData\Local\Temp\4c70d5b1c63a468f7e0aedf64f93ca42.exe
"C:\Users\Admin\AppData\Local\Temp\4c70d5b1c63a468f7e0aedf64f93ca42.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768

C:\Users\Admin\AppData\Local\Temp\4c70d5b1c63a468f7e0aedf64f93ca42.exe
"C:\Users\Admin\AppData\Local\Temp\4c70d5b1c63a468f7e0aedf64f93ca42.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2032

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1768-54-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/1768-56-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/2032-58-0x000000000041D460-mapping.dmp

Download
memory/2032-59-0x0000000000070000-0x0000000000099000-memory.dmp

Filesize
164KB

Download
memory/2032-60-0x0000000000880000-0x0000000000B83000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing