xloader | f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a

General

Target

f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe
Size

500KB
MD5

4b311f7098e8c26618b8c2c7366282f4
SHA1

816f73aa214c87fe2704dc8c6a9831f18969ca9b
SHA256

f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a
SHA512

da874e66b92be42ec1d2104fe44d8e09383f6aebb192777c105dbbb5899e6f40a7a851791229ee0bdf9d880af50adfe67d60327c6f6ee22a33b096042affec15

Score

10^/10

xloader pufi loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pufi

C2

http://www.homestechs.com/pufi/

Decoy

fusiongroupgames.net

hugevari.com

rebeccagriffiths.com

trocaoferta.com

theslashapp.com

codezonesoftware.xyz

sottocommunications.com

minicreators.online

course2millions.com

hfm5n1dhkjqwpe.xyz

xlab-ub.com

silvanaribeirocake.com

thefabinteriordesign.com

mg-leadership.com

petbort.com

ndust.net

203040302.xyz

jakital.com

shophuunghia.info

rednacionaldejuecesrd.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3756-124-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/3756-125-0x000000000041D450-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe

description	pid	process	target process
PID 2816 set thread context of 3756	2816	f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe	f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe

pid	process
3756	f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe
3756	f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe

description	pid	process	target process
PID 2816 wrote to memory of 3756	2816	f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe	f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe
PID 2816 wrote to memory of 3756	2816	f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe	f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe
PID 2816 wrote to memory of 3756	2816	f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe	f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe
PID 2816 wrote to memory of 3756	2816	f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe	f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe
PID 2816 wrote to memory of 3756	2816	f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe	f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe
PID 2816 wrote to memory of 3756	2816	f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe	f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe

C:\Users\Admin\AppData\Local\Temp\f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe
"C:\Users\Admin\AppData\Local\Temp\f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2816

C:\Users\Admin\AppData\Local\Temp\f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe
"C:\Users\Admin\AppData\Local\Temp\f1f2892cd08386e6af2477ff8340a60afb66ac66509e660c76818ea721c7fe6a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2816-115-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/2816-117-0x0000000005CB0000-0x0000000005CB1000-memory.dmp

Filesize
4KB

Download
memory/2816-118-0x00000000057B0000-0x00000000057B1000-memory.dmp

Filesize
4KB

Download
memory/2816-119-0x00000000057B0000-0x0000000005CAE000-memory.dmp

Filesize
5.0MB

Download
memory/2816-120-0x0000000005B90000-0x0000000005B91000-memory.dmp

Filesize
4KB

Download
memory/2816-121-0x0000000005B60000-0x0000000005B67000-memory.dmp

Filesize
28KB

Download
memory/2816-122-0x0000000006550000-0x0000000006551000-memory.dmp

Filesize
4KB

Download
memory/2816-123-0x0000000006500000-0x000000000654A000-memory.dmp

Filesize
296KB

Download
memory/3756-124-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3756-125-0x000000000041D450-mapping.dmp

Download
memory/3756-126-0x00000000014C0000-0x00000000017E0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads