xloader | 945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a

General

Target

945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe
Size

816KB
MD5

c4839f9e9d80100927eb39678175bbe6
SHA1

f88c6cf0e37bce13bf8317f86bbd3640d6badd4d
SHA256

945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a
SHA512

0166f4b2e46b183691b57715519c7176db7f61578001b4b2cba5e1173e562eb998ad2fa6cbfeddafe408df979b4805afe94bcec478cc4eddc6111046a0c6c073

Score

10^/10

xloader mwev loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mwev

C2

http://www.scion-go-getter.com/mwev/

Decoy

9linefarms.com

meadow-spring.com

texascountrycharts.com

chinatowndeliver.com

grindsword.com

thegurusigavebirthto.com

rip-online.com

lm-safe-keepingtoyof6.xyz

plumbtechconsulting.com

jgoerlach.com

inbloomsolutions.com

foxandmew.com

tikomobile.store

waybunch.com

thepatriottutor.com

qask.top

pharmacylinked.com

ishii-miona.com

sugarandrocks.com

anabolenpower.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/764-128-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/764-129-0x000000000041D480-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe

description	pid	process	target process
PID 3576 set thread context of 764	3576	945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe	945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe

pid	process
764	945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe
764	945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe

description	pid	process	target process
PID 3576 wrote to memory of 764	3576	945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe	945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe
PID 3576 wrote to memory of 764	3576	945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe	945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe
PID 3576 wrote to memory of 764	3576	945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe	945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe
PID 3576 wrote to memory of 764	3576	945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe	945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe
PID 3576 wrote to memory of 764	3576	945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe	945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe
PID 3576 wrote to memory of 764	3576	945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe	945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe

C:\Users\Admin\AppData\Local\Temp\945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe
"C:\Users\Admin\AppData\Local\Temp\945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3576

C:\Users\Admin\AppData\Local\Temp\945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe
"C:\Users\Admin\AppData\Local\Temp\945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/764-128-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/764-129-0x000000000041D480-mapping.dmp

Download
memory/764-130-0x00000000015A0000-0x00000000018C0000-memory.dmp

Filesize
3.1MB

Download
memory/3576-118-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/3576-120-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download
memory/3576-121-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/3576-122-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/3576-123-0x0000000005070000-0x0000000005077000-memory.dmp

Filesize
28KB

Download
memory/3576-124-0x0000000004E20000-0x000000000531E000-memory.dmp

Filesize
5.0MB

Download
memory/3576-125-0x0000000007590000-0x0000000007591000-memory.dmp

Filesize
4KB

Download
memory/3576-126-0x0000000007540000-0x000000000758E000-memory.dmp

Filesize
312KB

Download
memory/3576-127-0x0000000007740000-0x000000000776C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads