xloader | cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6

General

Target

cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe
Size

371KB
MD5

f4eb13ef6fef846933c731aecae8f978
SHA1

f27a8de41120825fc9a59b05e79bb92ccc766b2d
SHA256

cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6
SHA512

b5bd82041cd093a42aca06b7628dd1d3c93948c4919bab0a3e88bca828e87240a9e755f5759a9c092d9b67351952c589cecb251ff97f52ccff5c8d60c68f02c0

Score

10^/10

xloader mwev loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mwev

C2

http://www.scion-go-getter.com/mwev/

Decoy

9linefarms.com

meadow-spring.com

texascountrycharts.com

chinatowndeliver.com

grindsword.com

thegurusigavebirthto.com

rip-online.com

lm-safe-keepingtoyof6.xyz

plumbtechconsulting.com

jgoerlach.com

inbloomsolutions.com

foxandmew.com

tikomobile.store

waybunch.com

thepatriottutor.com

qask.top

pharmacylinked.com

ishii-miona.com

sugarandrocks.com

anabolenpower.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/4040-128-0x000000000041D480-mapping.dmp	xloader
behavioral1/memory/4040-127-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe

description	pid	process	target process
PID 2380 set thread context of 4040	2380	cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe	cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe

pid	process
4040	cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe
4040	cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe

description	pid	process	target process
PID 2380 wrote to memory of 4040	2380	cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe	cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe
PID 2380 wrote to memory of 4040	2380	cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe	cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe
PID 2380 wrote to memory of 4040	2380	cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe	cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe
PID 2380 wrote to memory of 4040	2380	cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe	cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe
PID 2380 wrote to memory of 4040	2380	cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe	cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe
PID 2380 wrote to memory of 4040	2380	cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe	cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe

C:\Users\Admin\AppData\Local\Temp\cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe
"C:\Users\Admin\AppData\Local\Temp\cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2380

C:\Users\Admin\AppData\Local\Temp\cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe
"C:\Users\Admin\AppData\Local\Temp\cd53040ec21c86fa58a23ef8a844b96b05454800c6aabe0e9d5772e3ab07bce6.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-118-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/2380-120-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/2380-121-0x0000000004A60000-0x0000000004A61000-memory.dmp

Filesize
4KB

Download
memory/2380-122-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/2380-123-0x00000000064C0000-0x00000000064C6000-memory.dmp

Filesize
24KB

Download
memory/2380-124-0x00000000049C0000-0x0000000004EBE000-memory.dmp

Filesize
5.0MB

Download
memory/2380-125-0x0000000006E20000-0x0000000006E21000-memory.dmp

Filesize
4KB

Download
memory/2380-126-0x00000000067D0000-0x0000000006829000-memory.dmp

Filesize
356KB

Download
memory/4040-128-0x000000000041D480-mapping.dmp

Download
memory/4040-127-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4040-129-0x0000000001080000-0x00000000013A0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads