xloader | dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba

General

Target

dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe
Size

370KB
MD5

0ae572452cbd392f8507184620811203
SHA1

3d01d532981417ea736449f3894352dd7f50d610
SHA256

dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba
SHA512

eb1a612a77edca89de192a71402aac87b75a716366da040aaf65ef7e707c09630734b5a3ac2a3e5bb0031b0988ce9e423c556243b93763a1b6fcd6d01d976dfc

Score

10^/10

xloader ef6c loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3980-125-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/3980-126-0x000000000041D3D0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe

description	pid	process	target process
PID 2368 set thread context of 3980	2368	dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe	dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe

pid	process
3980	dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe
3980	dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe

description	pid	process	target process
PID 2368 wrote to memory of 3980	2368	dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe	dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe
PID 2368 wrote to memory of 3980	2368	dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe	dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe
PID 2368 wrote to memory of 3980	2368	dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe	dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe
PID 2368 wrote to memory of 3980	2368	dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe	dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe
PID 2368 wrote to memory of 3980	2368	dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe	dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe
PID 2368 wrote to memory of 3980	2368	dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe	dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe

C:\Users\Admin\AppData\Local\Temp\dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe
"C:\Users\Admin\AppData\Local\Temp\dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2368

C:\Users\Admin\AppData\Local\Temp\dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe
"C:\Users\Admin\AppData\Local\Temp\dbeea7b74c941b6b567e7f12fa575d8b09650116bfb583604d6c50991cf351ba.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2368-115-0x0000000000E80000-0x0000000000EE2000-memory.dmp

Filesize
392KB

Download
memory/2368-116-0x0000000000E80000-0x0000000000EE2000-memory.dmp

Filesize
392KB

Download
memory/2368-117-0x0000000005D00000-0x00000000061FE000-memory.dmp

Filesize
5.0MB

Download
memory/2368-118-0x0000000005710000-0x00000000057A2000-memory.dmp

Filesize
584KB

Download
memory/2368-119-0x0000000005800000-0x0000000005CFE000-memory.dmp

Filesize
5.0MB

Download
memory/2368-120-0x00000000057B0000-0x00000000057BA000-memory.dmp

Filesize
40KB

Download
memory/2368-121-0x0000000005A00000-0x0000000005A9C000-memory.dmp

Filesize
624KB

Download
memory/2368-122-0x0000000005920000-0x000000000592E000-memory.dmp

Filesize
56KB

Download
memory/2368-123-0x0000000007BE0000-0x0000000007C2B000-memory.dmp

Filesize
300KB

Download
memory/2368-124-0x0000000008020000-0x000000000807E000-memory.dmp

Filesize
376KB

Download
memory/3980-125-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3980-126-0x000000000041D3D0-mapping.dmp

Download
memory/3980-127-0x0000000001990000-0x0000000001CB0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads