xloader | 7f59792dc652d6c0a6553b374fa1b6d4b9fe743a7853ca80a4f0182af5087f8c

General

Target

tmp/5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe
Size

429KB
MD5

72c898545f4ecfa97bc2668903c507da
SHA1

5ba163a20b952c8c7f84b1c90938cac5b78c8d68
SHA256

7f59792dc652d6c0a6553b374fa1b6d4b9fe743a7853ca80a4f0182af5087f8c
SHA512

562fb3e5af040452bd67e97d1a5ef2713019f462e6cb525ec793a0a9611acc3ec54278b02d50e3d64847be3193cc86899aec1cfab4b9d3588da254d3b93e68ce

Score

10^/10

xloader ef6c loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4428-124-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/4428-125-0x000000000041D3D0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe

description	pid	process	target process
PID 3600 set thread context of 4428	3600	5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe	5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe

pid process

4428 5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe
4428 5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe

pid	process
4428	5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe
4428	5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe

description	pid	process	target process
PID 3600 wrote to memory of 4428	3600	5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe	5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe
PID 3600 wrote to memory of 4428	3600	5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe	5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe
PID 3600 wrote to memory of 4428	3600	5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe	5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe
PID 3600 wrote to memory of 4428	3600	5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe	5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe
PID 3600 wrote to memory of 4428	3600	5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe	5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe
PID 3600 wrote to memory of 4428	3600	5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe	5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe

C:\Users\Admin\AppData\Local\Temp\tmp\5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3600

C:\Users\Admin\AppData\Local\Temp\tmp\5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\5d023139-77cb-418e-90f7-9176500b0f46_www-9.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3600-115-0x0000000000E50000-0x0000000000EC2000-memory.dmp

Filesize
456KB

Download
memory/3600-116-0x0000000000E50000-0x0000000000EC2000-memory.dmp

Filesize
456KB

Download
memory/3600-117-0x0000000005BD0000-0x00000000060CE000-memory.dmp

Filesize
5.0MB

Download
memory/3600-118-0x0000000005770000-0x0000000005802000-memory.dmp

Filesize
584KB

Download
memory/3600-119-0x00000000056D0000-0x0000000005BCE000-memory.dmp

Filesize
5.0MB

Download
memory/3600-120-0x0000000005710000-0x000000000571A000-memory.dmp

Filesize
40KB

Download
memory/3600-121-0x0000000008D00000-0x0000000008D9C000-memory.dmp

Filesize
624KB

Download
memory/3600-122-0x0000000005BC0000-0x0000000005BCC000-memory.dmp

Filesize
48KB

Download
memory/3600-123-0x0000000008DA0000-0x0000000008E00000-memory.dmp

Filesize
384KB

Download
memory/4428-124-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4428-125-0x000000000041D3D0-mapping.dmp

Download
memory/4428-126-0x00000000015F0000-0x0000000001910000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads