xloader | 32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e

General

Target

32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe
Size

993KB
MD5

2e81ceb459073a4988b86572485ce064
SHA1

537788a13b833bbe3993e6ddd3f4c1abf12caf94
SHA256

32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e
SHA512

fa7e4ba4c10db2914051df3dc62108fdf545e1ac26e32498b0fc539bd874146b355c6e59892b870b254fad1f2b4468d99e4872da5f661916ecabfd76bda58b4a

Score

10^/10

xloader mwev loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mwev

C2

http://www.scion-go-getter.com/mwev/

Decoy

9linefarms.com

meadow-spring.com

texascountrycharts.com

chinatowndeliver.com

grindsword.com

thegurusigavebirthto.com

rip-online.com

lm-safe-keepingtoyof6.xyz

plumbtechconsulting.com

jgoerlach.com

inbloomsolutions.com

foxandmew.com

tikomobile.store

waybunch.com

thepatriottutor.com

qask.top

pharmacylinked.com

ishii-miona.com

sugarandrocks.com

anabolenpower.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3504-125-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/3504-126-0x000000000041D480-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe

description	pid	process	target process
PID 2172 set thread context of 3504	2172	32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe	32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe

pid	process
3504	32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe
3504	32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe

description	pid	process	target process
PID 2172 wrote to memory of 3504	2172	32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe	32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe
PID 2172 wrote to memory of 3504	2172	32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe	32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe
PID 2172 wrote to memory of 3504	2172	32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe	32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe
PID 2172 wrote to memory of 3504	2172	32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe	32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe
PID 2172 wrote to memory of 3504	2172	32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe	32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe
PID 2172 wrote to memory of 3504	2172	32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe	32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe

C:\Users\Admin\AppData\Local\Temp\32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe
"C:\Users\Admin\AppData\Local\Temp\32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2172

C:\Users\Admin\AppData\Local\Temp\32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe
"C:\Users\Admin\AppData\Local\Temp\32121f53dac2e51662a709562a1247db9ff6a76ed8a5efd68492f28b9a25370e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2172-115-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/2172-117-0x0000000005550000-0x0000000005551000-memory.dmp

Filesize
4KB

Download
memory/2172-118-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/2172-119-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/2172-120-0x0000000008570000-0x0000000008577000-memory.dmp

Filesize
28KB

Download
memory/2172-121-0x0000000008580000-0x0000000008581000-memory.dmp

Filesize
4KB

Download
memory/2172-122-0x0000000005050000-0x000000000554E000-memory.dmp

Filesize
5.0MB

Download
memory/2172-123-0x00000000085E0000-0x00000000085E1000-memory.dmp

Filesize
4KB

Download
memory/2172-124-0x0000000008680000-0x0000000008797000-memory.dmp

Filesize
1.1MB

Download
memory/3504-125-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3504-126-0x000000000041D480-mapping.dmp

Download
memory/3504-127-0x0000000001910000-0x0000000001C30000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads