xloader | ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b

General

Target

ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe
Size

1.0MB
MD5

5c3e5bb82655b9e9d4c4de37b8261e9c
SHA1

8729efef21702fa0af0ddf315fb6f07e1086fe65
SHA256

ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b
SHA512

f0684c7dd659506fbf446e5f0a543b03964a3eeb0e53345e99efa8582e1e743fb01a2caeb6febb4efba32cfb5aff959dd9f8bc1c06aa1397671dd8e16c5299b3

Score

10^/10

xloader ea0r loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ea0r

C2

http://www.asiapubz-hk.com/ea0r/

Decoy

lionheartcreativestudios.com

konzertmanagement.com

blackpanther.online

broychim-int.com

takut18.com

txstarsolar.com

herdsherpa.com

igorshestakov.com

shinesbox.com

reflectpkljlt.xyz

oiltoolshub.com

viralmoneychallenge.com

changingalphastrategies.com

mecitiris.com

rdadmin.online

miniambiente.com

kominarcine.com

pino-almond.com

heihit.xyz

junqi888.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1640-128-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1640-129-0x000000000041D410-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe

description	pid	process	target process
PID 2592 set thread context of 1640	2592	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exece5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe

pid	process
2592	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe
2592	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe
2592	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe
2592	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe
1640	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe
1640	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe

description pid process

Token: SeDebugPrivilege 2592 ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe

description	pid	process
Token: SeDebugPrivilege	2592	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe

description	pid	process	target process
PID 2592 wrote to memory of 1516	2592	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe
PID 2592 wrote to memory of 1516	2592	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe
PID 2592 wrote to memory of 1516	2592	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe
PID 2592 wrote to memory of 1640	2592	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe
PID 2592 wrote to memory of 1640	2592	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe
PID 2592 wrote to memory of 1640	2592	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe
PID 2592 wrote to memory of 1640	2592	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe
PID 2592 wrote to memory of 1640	2592	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe
PID 2592 wrote to memory of 1640	2592	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe	ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe

C:\Users\Admin\AppData\Local\Temp\ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe
"C:\Users\Admin\AppData\Local\Temp\ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592

C:\Users\Admin\AppData\Local\Temp\ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe
"C:\Users\Admin\AppData\Local\Temp\ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe"
2⤵
PID:1516

C:\Users\Admin\AppData\Local\Temp\ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe
"C:\Users\Admin\AppData\Local\Temp\ce5ef050cbfe862b46edb70c1d3ee90b1fc3940ef93ee7fffe642589673d331b.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1640-128-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1640-129-0x000000000041D410-mapping.dmp

Download
memory/1640-130-0x0000000001920000-0x0000000001C40000-memory.dmp

Filesize
3.1MB

Download
memory/2592-118-0x0000000000B90000-0x0000000000B91000-memory.dmp

Filesize
4KB

Download
memory/2592-120-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

Filesize
4KB

Download
memory/2592-121-0x0000000005520000-0x0000000005521000-memory.dmp

Filesize
4KB

Download
memory/2592-122-0x00000000054C0000-0x00000000054C1000-memory.dmp

Filesize
4KB

Download
memory/2592-123-0x00000000055F0000-0x0000000005AEE000-memory.dmp

Filesize
5.0MB

Download
memory/2592-124-0x00000000055D0000-0x00000000055D5000-memory.dmp

Filesize
20KB

Download
memory/2592-125-0x0000000007470000-0x0000000007471000-memory.dmp

Filesize
4KB

Download
memory/2592-126-0x0000000007A10000-0x0000000007A11000-memory.dmp

Filesize
4KB

Download
memory/2592-127-0x0000000007AB0000-0x0000000007BC6000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads