xloader | 877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48

General

Target

877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
Size

542KB
MD5

d23ca1a68c0067ad0bd32dda2109c7db
SHA1

de14528b88027332f2c406f42f23c68cf16ec11e
SHA256

877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48
SHA512

6ddf12ab12785b5ea4687e9bcbbfe40f0ad4b916576ead6789ac56f09f6216c352912d2458b17fead6383c0fc572a0a617f15d43c36dfa897ab22155b8f61213

Score

10^/10

xloader pufi loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pufi

C2

http://www.homestechs.com/pufi/

Decoy

fusiongroupgames.net

hugevari.com

rebeccagriffiths.com

trocaoferta.com

theslashapp.com

codezonesoftware.xyz

sottocommunications.com

minicreators.online

course2millions.com

hfm5n1dhkjqwpe.xyz

xlab-ub.com

silvanaribeirocake.com

thefabinteriordesign.com

mg-leadership.com

petbort.com

ndust.net

203040302.xyz

jakital.com

shophuunghia.info

rednacionaldejuecesrd.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3684-124-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/3684-125-0x000000000041D450-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe

description	pid	process	target process
PID 2796 set thread context of 3684	2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe

pid	process
2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
3684	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
3684	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe

description pid process

Token: SeDebugPrivilege 2796 877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe

description	pid	process
Token: SeDebugPrivilege	2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe

description	pid	process	target process
PID 2796 wrote to memory of 3660	2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
PID 2796 wrote to memory of 3660	2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
PID 2796 wrote to memory of 3660	2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
PID 2796 wrote to memory of 3748	2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
PID 2796 wrote to memory of 3748	2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
PID 2796 wrote to memory of 3748	2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
PID 2796 wrote to memory of 3684	2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
PID 2796 wrote to memory of 3684	2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
PID 2796 wrote to memory of 3684	2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
PID 2796 wrote to memory of 3684	2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
PID 2796 wrote to memory of 3684	2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
PID 2796 wrote to memory of 3684	2796	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe	877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe

C:\Users\Admin\AppData\Local\Temp\877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
"C:\Users\Admin\AppData\Local\Temp\877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796

C:\Users\Admin\AppData\Local\Temp\877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
"C:\Users\Admin\AppData\Local\Temp\877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe"
2⤵
PID:3660

C:\Users\Admin\AppData\Local\Temp\877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
"C:\Users\Admin\AppData\Local\Temp\877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe"
2⤵
PID:3748

C:\Users\Admin\AppData\Local\Temp\877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe
"C:\Users\Admin\AppData\Local\Temp\877727126dd647bbd23c00721d01b1bbe752a01f1943f89a35f3ba7c908f1a48.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2796-115-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/2796-117-0x0000000005720000-0x0000000005721000-memory.dmp

Filesize
4KB

Download
memory/2796-118-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/2796-119-0x0000000005220000-0x000000000571E000-memory.dmp

Filesize
5.0MB

Download
memory/2796-120-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download
memory/2796-121-0x0000000005690000-0x0000000005696000-memory.dmp

Filesize
24KB

Download
memory/2796-122-0x0000000008970000-0x0000000008971000-memory.dmp

Filesize
4KB

Download
memory/2796-123-0x0000000007000000-0x000000000704B000-memory.dmp

Filesize
300KB

Download
memory/3684-124-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3684-125-0x000000000041D450-mapping.dmp

Download
memory/3684-126-0x00000000012F0000-0x0000000001610000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads