xloader | 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82

General

Target

5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe
Size

290KB
MD5

521339ae9fa89c3af1b50456781272a8
SHA1

3e79f4911ff9187b0300dcca9d0dcc6108afaecb
SHA256

5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82
SHA512

54a1f89f2711ed2aa8d10e0a57bf287b84ca02be78e42960bf4defbb8bbfb6707bc58052a433a199f05121b8e155105209c409afe9e81547c7e573f39acddff3

Score

10^/10

xloader pufi loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pufi

C2

http://www.homestechs.com/pufi/

Decoy

fusiongroupgames.net

hugevari.com

rebeccagriffiths.com

trocaoferta.com

theslashapp.com

codezonesoftware.xyz

sottocommunications.com

minicreators.online

course2millions.com

hfm5n1dhkjqwpe.xyz

xlab-ub.com

silvanaribeirocake.com

thefabinteriordesign.com

mg-leadership.com

petbort.com

ndust.net

203040302.xyz

jakital.com

shophuunghia.info

rednacionaldejuecesrd.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/428-63-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/428-64-0x000000000041D450-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe

description	pid	process	target process
PID 1232 set thread context of 428	1232	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe

pid	process
1232	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe
1232	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe
428	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe

description pid process

Token: SeDebugPrivilege 1232 5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe

description	pid	process
Token: SeDebugPrivilege	1232	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe

description	pid	process	target process
PID 1232 wrote to memory of 428	1232	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe
PID 1232 wrote to memory of 428	1232	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe
PID 1232 wrote to memory of 428	1232	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe
PID 1232 wrote to memory of 428	1232	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe
PID 1232 wrote to memory of 428	1232	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe
PID 1232 wrote to memory of 428	1232	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe
PID 1232 wrote to memory of 428	1232	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe	5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe

C:\Users\Admin\AppData\Local\Temp\5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe
"C:\Users\Admin\AppData\Local\Temp\5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232

C:\Users\Admin\AppData\Local\Temp\5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe
C:\Users\Admin\AppData\Local\Temp\5d5cd3bd60e148bcfc1b78e13836f43c684b21babdeff5f036cda174ca122f82.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/428-61-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/428-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/428-63-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/428-64-0x000000000041D450-mapping.dmp

Download
memory/428-65-0x0000000000920000-0x0000000000C23000-memory.dmp

Filesize
3.0MB

Download
memory/1232-55-0x0000000001370000-0x0000000001371000-memory.dmp

Filesize
4KB

Download
memory/1232-57-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/1232-58-0x0000000075821000-0x0000000075823000-memory.dmp

Filesize
8KB

Download
memory/1232-59-0x0000000005140000-0x00000000051A0000-memory.dmp

Filesize
384KB

Download
memory/1232-60-0x0000000000690000-0x00000000006BA000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads