xloader | 211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e

General

Target

211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe
Size

428KB
MD5

1dadf13b8e0441e370eacb0b774c64e9
SHA1

ad139b332854cdb6afb1c25548c72e5f59cda993
SHA256

211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e
SHA512

e086f7238871070896e2454e1ab6c6f7248039742d67089f8e7c14fabbc890ca23b3ca1d240881f386af316f15f9192f20df85b15bf4d9c7b27ce4305098eb50

Score

10^/10

xloader unzn loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

unzn

C2

http://www.davanamays.com/unzn/

Decoy

xiulf.com

highcountrymortar.com

523561.com

marketingagency.tools

ganmovie.net

nationaalcontactpunt.com

sirrbter.com

begizas.xyz

missimi-fashion.com

munixc.info

daas.support

spaceworbc.com

faithtruthresolve.com

gymkub.com

thegrayverse.xyz

artisanmakefurniture.com

029tryy.com

ijuubx.biz

iphone13promax.club

techuniversus.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2740-127-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2740-128-0x000000000041D430-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe

description	pid	process	target process
PID 4092 set thread context of 2740	4092	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe

pid	process
4092	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe
4092	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe
2740	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe
2740	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe

description pid process

Token: SeDebugPrivilege 4092 211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe

description	pid	process
Token: SeDebugPrivilege	4092	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe

description	pid	process	target process
PID 4092 wrote to memory of 1852	4092	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe
PID 4092 wrote to memory of 1852	4092	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe
PID 4092 wrote to memory of 1852	4092	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe
PID 4092 wrote to memory of 2740	4092	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe
PID 4092 wrote to memory of 2740	4092	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe
PID 4092 wrote to memory of 2740	4092	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe
PID 4092 wrote to memory of 2740	4092	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe
PID 4092 wrote to memory of 2740	4092	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe
PID 4092 wrote to memory of 2740	4092	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe	211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe

C:\Users\Admin\AppData\Local\Temp\211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe
"C:\Users\Admin\AppData\Local\Temp\211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092

C:\Users\Admin\AppData\Local\Temp\211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe
"C:\Users\Admin\AppData\Local\Temp\211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe"
2⤵
PID:1852

C:\Users\Admin\AppData\Local\Temp\211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe
"C:\Users\Admin\AppData\Local\Temp\211285d0278cfa608b2f7e0280641bdb07816ddca9fb7b8d70d9f0c8cf7bdb6e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2740-127-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2740-128-0x000000000041D430-mapping.dmp

Download
memory/2740-129-0x00000000015A0000-0x00000000018C0000-memory.dmp

Filesize
3.1MB

Download
memory/4092-118-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/4092-120-0x0000000005C70000-0x0000000005C71000-memory.dmp

Filesize
4KB

Download
memory/4092-121-0x0000000005770000-0x0000000005771000-memory.dmp

Filesize
4KB

Download
memory/4092-122-0x0000000005730000-0x0000000005731000-memory.dmp

Filesize
4KB

Download
memory/4092-123-0x00000000058F0000-0x00000000058F7000-memory.dmp

Filesize
28KB

Download
memory/4092-124-0x0000000005770000-0x0000000005C6E000-memory.dmp

Filesize
5.0MB

Download
memory/4092-125-0x0000000006510000-0x0000000006511000-memory.dmp

Filesize
4KB

Download
memory/4092-126-0x00000000064C0000-0x0000000006506000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads