xloader | 8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f

General

Target

8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe
Size

528KB
MD5

2b5dc0ab0d788a63f4a09f80c2de0799
SHA1

25d10abffaa19611b1376d8e3bd1a541fdc6afed
SHA256

8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f
SHA512

7456bb3e5bee9626d7fa285c0112eb764327678f3f451b640d1f0de4fac46e6c0a0a8cf3f893a56ef5037fea8d8f4c78e85a0132edfca4a22b7e399705386311

Score

10^/10

xloader pufi loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pufi

C2

http://www.homestechs.com/pufi/

Decoy

fusiongroupgames.net

hugevari.com

rebeccagriffiths.com

trocaoferta.com

theslashapp.com

codezonesoftware.xyz

sottocommunications.com

minicreators.online

course2millions.com

hfm5n1dhkjqwpe.xyz

xlab-ub.com

silvanaribeirocake.com

thefabinteriordesign.com

mg-leadership.com

petbort.com

ndust.net

203040302.xyz

jakital.com

shophuunghia.info

rednacionaldejuecesrd.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/320-124-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/320-125-0x000000000041D450-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe

description	pid	process	target process
PID 760 set thread context of 320	760	8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe	8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe

pid	process
320	8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe
320	8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe

description	pid	process	target process
PID 760 wrote to memory of 320	760	8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe	8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe
PID 760 wrote to memory of 320	760	8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe	8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe
PID 760 wrote to memory of 320	760	8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe	8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe
PID 760 wrote to memory of 320	760	8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe	8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe
PID 760 wrote to memory of 320	760	8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe	8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe
PID 760 wrote to memory of 320	760	8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe	8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe

C:\Users\Admin\AppData\Local\Temp\8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe
"C:\Users\Admin\AppData\Local\Temp\8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:760

C:\Users\Admin\AppData\Local\Temp\8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe
"C:\Users\Admin\AppData\Local\Temp\8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-124-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/320-125-0x000000000041D450-mapping.dmp

Download
memory/320-126-0x00000000014E0000-0x0000000001800000-memory.dmp

Filesize
3.1MB

Download
memory/760-115-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download
memory/760-117-0x0000000005780000-0x0000000005781000-memory.dmp

Filesize
4KB

Download
memory/760-118-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/760-119-0x0000000005280000-0x000000000577E000-memory.dmp

Filesize
5.0MB

Download
memory/760-120-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/760-121-0x0000000005260000-0x0000000005266000-memory.dmp

Filesize
24KB

Download
memory/760-122-0x0000000005F20000-0x0000000005F21000-memory.dmp

Filesize
4KB

Download
memory/760-123-0x0000000005E80000-0x0000000005ECC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads