xloader | 5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d

General

Target

5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe
Size

569KB
MD5

d369781ed2d0848e769bd4e466318920
SHA1

4808ca1792f13e061bf29b055ae83a5edaf18e3b
SHA256

5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d
SHA512

5a83149de7eba4f736719892025eda984cfe40069e9b8916a4f44338d8c34d9e9346a24f05e2f8c0b67d2d4183ba0f4ea17dd322c1095844412bce329c233688

Score

10^/10

xloader ef6c loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

C2

http://www.fis.photos/ef6c/

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2584-124-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2584-125-0x000000000041D3D0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe

description	pid	process	target process
PID 1720 set thread context of 2584	1720	5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe	5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe

pid	process
2584	5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe
2584	5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe

description	pid	process	target process
PID 1720 wrote to memory of 2584	1720	5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe	5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe
PID 1720 wrote to memory of 2584	1720	5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe	5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe
PID 1720 wrote to memory of 2584	1720	5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe	5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe
PID 1720 wrote to memory of 2584	1720	5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe	5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe
PID 1720 wrote to memory of 2584	1720	5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe	5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe
PID 1720 wrote to memory of 2584	1720	5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe	5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe

C:\Users\Admin\AppData\Local\Temp\5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe
"C:\Users\Admin\AppData\Local\Temp\5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1720

C:\Users\Admin\AppData\Local\Temp\5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe
"C:\Users\Admin\AppData\Local\Temp\5a1261b8c98d7ec6edfe8e470f857336557c6ed317822117dece6012306f170d.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-115-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/1720-117-0x00000000052D0000-0x00000000052D1000-memory.dmp

Filesize
4KB

Download
memory/1720-118-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/1720-119-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/1720-120-0x0000000004DD0000-0x00000000052CE000-memory.dmp

Filesize
5.0MB

Download
memory/1720-121-0x0000000004F00000-0x0000000004F05000-memory.dmp

Filesize
20KB

Download
memory/1720-122-0x00000000070E0000-0x00000000070E1000-memory.dmp

Filesize
4KB

Download
memory/1720-123-0x0000000006AD0000-0x0000000006B1B000-memory.dmp

Filesize
300KB

Download
memory/2584-124-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2584-125-0x000000000041D3D0-mapping.dmp

Download
memory/2584-126-0x00000000012D0000-0x00000000015F0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads