xloader | 17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d

General

Target

17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe
Size

324KB
MD5

e54e7ec5aa72f4d5bb128553728fb209
SHA1

75def864c40663258f582b8dd8cbad3905f74c56
SHA256

17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d
SHA512

f8c54bb005d5e1b443a03606580fc2c73a70bc6c97f76c1c42237c9cab119b7e25839031239bdf4653f101a2408860eeaade2c861c36ccfa53bc8c75ae36d473

Score

10^/10

xloader euzn loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euzn

C2

http://www.heser.net/euzn/

Decoy

235296tyc.com

gold12guide.art

baibuaherb.com

weberwines.tax

chezvitoria.com

aidenb.tech

pitchdeckservice.com

surgeryforfdf.xyz

workunvaccinated.com

hrtaro.com

yourotcs.com

sonimultispecialityclinic.com

consultantadvisors.com

pentesting-consulting.com

dantechs.digital

longshifa.online

taweilai.net

imyusuke.com

cashndashfinancial.com

fasiglimt.quest

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3676-125-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/3676-126-0x000000000041D420-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe

description	pid	process	target process
PID 2740 set thread context of 3676	2740	17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe	17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe

pid	process
3676	17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe
3676	17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe

description	pid	process	target process
PID 2740 wrote to memory of 3676	2740	17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe	17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe
PID 2740 wrote to memory of 3676	2740	17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe	17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe
PID 2740 wrote to memory of 3676	2740	17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe	17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe
PID 2740 wrote to memory of 3676	2740	17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe	17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe
PID 2740 wrote to memory of 3676	2740	17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe	17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe
PID 2740 wrote to memory of 3676	2740	17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe	17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe

C:\Users\Admin\AppData\Local\Temp\17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe
"C:\Users\Admin\AppData\Local\Temp\17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2740

C:\Users\Admin\AppData\Local\Temp\17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe
"C:\Users\Admin\AppData\Local\Temp\17ed64707506c917be6329e1cbe94548d761d218dc8e2d624eab99565acc055d.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2740-115-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/2740-117-0x0000000005700000-0x0000000005701000-memory.dmp

Filesize
4KB

Download
memory/2740-118-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/2740-119-0x0000000005200000-0x00000000056FE000-memory.dmp

Filesize
5.0MB

Download
memory/2740-120-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/2740-121-0x0000000005380000-0x0000000005381000-memory.dmp

Filesize
4KB

Download
memory/2740-122-0x0000000005DD0000-0x0000000005DD7000-memory.dmp

Filesize
28KB

Download
memory/2740-123-0x000000007F840000-0x000000007F841000-memory.dmp

Filesize
4KB

Download
memory/2740-124-0x0000000007920000-0x000000000796B000-memory.dmp

Filesize
300KB

Download
memory/3676-125-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3676-126-0x000000000041D420-mapping.dmp

Download
memory/3676-127-0x0000000001730000-0x0000000001A50000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads