xloader | 409d082509f1965c92e8be062f7dccb0b9af2458e720460658729468d44fef28

General

Target

1ac9a083e02365f726ee1e704ef5386e.exe
Size

548KB
MD5

1ac9a083e02365f726ee1e704ef5386e
SHA1

4636a5f47b55eef6d39ae6e99e7b90b7bc0e6fd5
SHA256

409d082509f1965c92e8be062f7dccb0b9af2458e720460658729468d44fef28
SHA512

50780d01741b51cad36c661cf9282ba3b5994bd2660997edebafaae18cbc5099a8800b3ae6ca8e8dd2d897318744a87d979ccd6a1c6304ada5e78fc92daf44b7

Score

10^/10

xloader mwev loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mwev

C2

http://www.scion-go-getter.com/mwev/

Decoy

9linefarms.com

meadow-spring.com

texascountrycharts.com

chinatowndeliver.com

grindsword.com

thegurusigavebirthto.com

rip-online.com

lm-safe-keepingtoyof6.xyz

plumbtechconsulting.com

jgoerlach.com

inbloomsolutions.com

foxandmew.com

tikomobile.store

waybunch.com

thepatriottutor.com

qask.top

pharmacylinked.com

ishii-miona.com

sugarandrocks.com

anabolenpower.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4028-127-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/4028-128-0x000000000041D480-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

1ac9a083e02365f726ee1e704ef5386e.exe

description pid process target process

PID 2376 set thread context of 4028 2376 1ac9a083e02365f726ee1e704ef5386e.exe 1ac9a083e02365f726ee1e704ef5386e.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1ac9a083e02365f726ee1e704ef5386e.exe

pid process

4028 1ac9a083e02365f726ee1e704ef5386e.exe
4028 1ac9a083e02365f726ee1e704ef5386e.exe

description	pid	process	target process
PID 2376 set thread context of 4028	2376	1ac9a083e02365f726ee1e704ef5386e.exe	1ac9a083e02365f726ee1e704ef5386e.exe

pid	process
4028	1ac9a083e02365f726ee1e704ef5386e.exe
4028	1ac9a083e02365f726ee1e704ef5386e.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1ac9a083e02365f726ee1e704ef5386e.exe

description	pid	process	target process
PID 2376 wrote to memory of 4028	2376	1ac9a083e02365f726ee1e704ef5386e.exe	1ac9a083e02365f726ee1e704ef5386e.exe
PID 2376 wrote to memory of 4028	2376	1ac9a083e02365f726ee1e704ef5386e.exe	1ac9a083e02365f726ee1e704ef5386e.exe
PID 2376 wrote to memory of 4028	2376	1ac9a083e02365f726ee1e704ef5386e.exe	1ac9a083e02365f726ee1e704ef5386e.exe
PID 2376 wrote to memory of 4028	2376	1ac9a083e02365f726ee1e704ef5386e.exe	1ac9a083e02365f726ee1e704ef5386e.exe
PID 2376 wrote to memory of 4028	2376	1ac9a083e02365f726ee1e704ef5386e.exe	1ac9a083e02365f726ee1e704ef5386e.exe
PID 2376 wrote to memory of 4028	2376	1ac9a083e02365f726ee1e704ef5386e.exe	1ac9a083e02365f726ee1e704ef5386e.exe

C:\Users\Admin\AppData\Local\Temp\1ac9a083e02365f726ee1e704ef5386e.exe
"C:\Users\Admin\AppData\Local\Temp\1ac9a083e02365f726ee1e704ef5386e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2376

C:\Users\Admin\AppData\Local\Temp\1ac9a083e02365f726ee1e704ef5386e.exe
"C:\Users\Admin\AppData\Local\Temp\1ac9a083e02365f726ee1e704ef5386e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2376-118-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/2376-120-0x0000000005460000-0x0000000005461000-memory.dmp

Filesize
4KB

Download
memory/2376-121-0x0000000005000000-0x0000000005001000-memory.dmp

Filesize
4KB

Download
memory/2376-122-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/2376-123-0x00000000051E0000-0x00000000051E6000-memory.dmp

Filesize
24KB

Download
memory/2376-124-0x0000000004F60000-0x000000000545E000-memory.dmp

Filesize
5.0MB

Download
memory/2376-125-0x0000000008890000-0x0000000008891000-memory.dmp

Filesize
4KB

Download
memory/2376-126-0x0000000008B30000-0x0000000008BAD000-memory.dmp

Filesize
500KB

Download
memory/4028-127-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4028-128-0x000000000041D480-mapping.dmp

Download
memory/4028-129-0x0000000001560000-0x0000000001880000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing