xloader | 7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515

General

Target

7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe
Size

1.0MB
MD5

290f5b81ba88a8699e9ebd35075f8a49
SHA1

fad9a5952517ded62e0839b4cc99a9ba2e9b2ac4
SHA256

7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515
SHA512

6e5a3c544d043f8e68b3156ae6789eaae496ec60be810cb5eafc4cdbb2a63e711c2da4a268ff72ef271bd6bcd5c23b5ca7cdbbc96635ffe8bb63d0956bf72b09

Score

10^/10

xloader ef6c loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

C2

http://www.fis.photos/ef6c/

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3264-125-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/3264-126-0x000000000041D3D0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe

description	pid	process	target process
PID 3032 set thread context of 3264	3032	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe

pid	process
3032	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe
3032	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe
3264	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe
3264	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe

description pid process

Token: SeDebugPrivilege 3032 7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe

description	pid	process
Token: SeDebugPrivilege	3032	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe

description	pid	process	target process
PID 3032 wrote to memory of 3460	3032	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe
PID 3032 wrote to memory of 3460	3032	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe
PID 3032 wrote to memory of 3460	3032	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe
PID 3032 wrote to memory of 3264	3032	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe
PID 3032 wrote to memory of 3264	3032	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe
PID 3032 wrote to memory of 3264	3032	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe
PID 3032 wrote to memory of 3264	3032	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe
PID 3032 wrote to memory of 3264	3032	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe
PID 3032 wrote to memory of 3264	3032	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe	7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe

C:\Users\Admin\AppData\Local\Temp\7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe
"C:\Users\Admin\AppData\Local\Temp\7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032

C:\Users\Admin\AppData\Local\Temp\7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe
"C:\Users\Admin\AppData\Local\Temp\7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe"
2⤵
PID:3460

C:\Users\Admin\AppData\Local\Temp\7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe
"C:\Users\Admin\AppData\Local\Temp\7403345ae9b5f3c9a0fdffbf0ae365c3995f7a05acb2d000bfcbf4a8ff6a6515.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3032-115-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/3032-117-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/3032-118-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/3032-119-0x00000000049A0000-0x0000000004E9E000-memory.dmp

Filesize
5.0MB

Download
memory/3032-120-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/3032-121-0x0000000004DA0000-0x0000000004DA7000-memory.dmp

Filesize
28KB

Download
memory/3032-122-0x0000000007F70000-0x0000000007F71000-memory.dmp

Filesize
4KB

Download
memory/3032-123-0x00000000082E0000-0x00000000082E1000-memory.dmp

Filesize
4KB

Download
memory/3032-124-0x00000000086A0000-0x00000000087B6000-memory.dmp

Filesize
1.1MB

Download
memory/3264-125-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3264-126-0x000000000041D3D0-mapping.dmp

Download
memory/3264-127-0x0000000001230000-0x0000000001550000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads