xloader | 74ff4d2208e19a63a977b014b74b8a2a5321cc7984ab97d1b80c1885b92c56ec

General

Target

TT Transmitted Copy TRVTT2200390.exe
Size

706KB
MD5

e08f07a15096d5eda6b9af217640692b
SHA1

d97dde29c20cc83def959ede08e0194db4cd3453
SHA256

071d14c83f00ed98e9c00926273cc741b6de2c4d74b7c02b63dce652ae5b8735
SHA512

dc529b138f4083608551dd0028c8d971724a06432000b56f8baf9b787a0e810248f4892a8ad68276f0416d01a52473bc96c6025814f6bde3c434bb8e940c6291

Score

10^/10

xloader n8bs loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

n8bs

Decoy

monese-bank.com

silkypumps.xyz

tashabouvier.com

eduardoleonsilva.com

pinnaclecorporaterentals.com

megafluids.com

worldwidecarfans.com

benjamlnesq.com

unitedraxiapp.com

thetanheroes.com

jypmore.quest

indianasheriffs.biz

saintinstead.com

alldansmx.com

trulyproofreading.com

indotogel369.com

mermadekusse.store

radosenterprisellc.com

gseequalservices.com

techride.xyz

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3496-125-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/3496-128-0x0000000001480000-0x0000000001614000-memory.dmp	xloader
behavioral2/memory/3752-131-0x0000000002860000-0x0000000002889000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

Processes:

TT Transmitted Copy TRVTT2200390.exeTT Transmitted Copy TRVTT2200390.execontrol.exe

description	pid	process	target process
PID 912 set thread context of 3496	912	TT Transmitted Copy TRVTT2200390.exe	TT Transmitted Copy TRVTT2200390.exe
PID 3496 set thread context of 3056	3496	TT Transmitted Copy TRVTT2200390.exe	Explorer.EXE
PID 3752 set thread context of 3056	3752	control.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 40 IoCs

Processes:

TT Transmitted Copy TRVTT2200390.execontrol.exe

pid	process
3496	TT Transmitted Copy TRVTT2200390.exe
3496	TT Transmitted Copy TRVTT2200390.exe
3496	TT Transmitted Copy TRVTT2200390.exe
3496	TT Transmitted Copy TRVTT2200390.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe
3752	control.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3056 Explorer.EXE

pid	process
3056	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

TT Transmitted Copy TRVTT2200390.execontrol.exe

pid	process
3496	TT Transmitted Copy TRVTT2200390.exe
3496	TT Transmitted Copy TRVTT2200390.exe
3496	TT Transmitted Copy TRVTT2200390.exe
3752	control.exe
3752	control.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

TT Transmitted Copy TRVTT2200390.execontrol.exe

description pid process

Token: SeDebugPrivilege 3496 TT Transmitted Copy TRVTT2200390.exe
Token: SeDebugPrivilege 3752 control.exe

description	pid	process
Token: SeDebugPrivilege	3496	TT Transmitted Copy TRVTT2200390.exe
Token: SeDebugPrivilege	3752	control.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

TT Transmitted Copy TRVTT2200390.exeExplorer.EXEcontrol.exe

description	pid	process	target process
PID 912 wrote to memory of 3496	912	TT Transmitted Copy TRVTT2200390.exe	TT Transmitted Copy TRVTT2200390.exe
PID 912 wrote to memory of 3496	912	TT Transmitted Copy TRVTT2200390.exe	TT Transmitted Copy TRVTT2200390.exe
PID 912 wrote to memory of 3496	912	TT Transmitted Copy TRVTT2200390.exe	TT Transmitted Copy TRVTT2200390.exe
PID 912 wrote to memory of 3496	912	TT Transmitted Copy TRVTT2200390.exe	TT Transmitted Copy TRVTT2200390.exe
PID 912 wrote to memory of 3496	912	TT Transmitted Copy TRVTT2200390.exe	TT Transmitted Copy TRVTT2200390.exe
PID 912 wrote to memory of 3496	912	TT Transmitted Copy TRVTT2200390.exe	TT Transmitted Copy TRVTT2200390.exe
PID 3056 wrote to memory of 3752	3056	Explorer.EXE	control.exe
PID 3056 wrote to memory of 3752	3056	Explorer.EXE	control.exe
PID 3056 wrote to memory of 3752	3056	Explorer.EXE	control.exe
PID 3752 wrote to memory of 2740	3752	control.exe	cmd.exe
PID 3752 wrote to memory of 2740	3752	control.exe	cmd.exe
PID 3752 wrote to memory of 2740	3752	control.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3056

C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe
"C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:912

C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe
"C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3752

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"
3⤵
PID:2740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-123-0x0000000008140000-0x00000000081DC000-memory.dmp

Filesize
624KB

Download
memory/912-124-0x00000000082E0000-0x000000000833E000-memory.dmp

Filesize
376KB

Download
memory/912-115-0x0000000000D20000-0x0000000000DD8000-memory.dmp

Filesize
736KB

Download
memory/912-118-0x0000000005700000-0x0000000005792000-memory.dmp

Filesize
584KB

Download
memory/912-119-0x0000000005740000-0x000000000574A000-memory.dmp

Filesize
40KB

Download
memory/912-120-0x0000000007AC0000-0x0000000007B60000-memory.dmp

Filesize
640KB

Download
memory/912-121-0x0000000007C10000-0x0000000007C1E000-memory.dmp

Filesize
56KB

Download
memory/912-122-0x0000000007DD0000-0x0000000007E1B000-memory.dmp

Filesize
300KB

Download
memory/912-117-0x0000000005830000-0x00000000058C2000-memory.dmp

Filesize
584KB

Download
memory/912-116-0x0000000005D30000-0x000000000622E000-memory.dmp

Filesize
5.0MB

Download
memory/3056-134-0x0000000005C10000-0x0000000005D53000-memory.dmp

Filesize
1.3MB

Download
memory/3056-129-0x0000000002590000-0x000000000266C000-memory.dmp

Filesize
880KB

Download
memory/3496-125-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3496-128-0x0000000001480000-0x0000000001614000-memory.dmp

Filesize
1.6MB

Download
memory/3496-127-0x0000000001620000-0x0000000001940000-memory.dmp

Filesize
3.1MB

Download
memory/3752-130-0x00000000001C0000-0x00000000001E0000-memory.dmp

Filesize
128KB

Download
memory/3752-131-0x0000000002860000-0x0000000002889000-memory.dmp

Filesize
164KB

Download
memory/3752-132-0x0000000004470000-0x0000000004790000-memory.dmp

Filesize
3.1MB

Download
memory/3752-133-0x00000000042D0000-0x000000000446E000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads