xloader | 6e728d7a2e88ba45765fb4bbb1de4ddda1b3a402d5f31c04eddafe1962ab993c

General

Target

e4c892aef5cc8a224af323c3ad222a50.exe
Size

816KB
MD5

e4c892aef5cc8a224af323c3ad222a50
SHA1

e531fdbeee32fd4250f3d582b06aa03afc01a17e
SHA256

6e728d7a2e88ba45765fb4bbb1de4ddda1b3a402d5f31c04eddafe1962ab993c
SHA512

24c645cc4ea4b9ce77d0dcf2ccd3f353f15ab383ef9cfbb11796efe0cf9a80fbb0d364b98df0e459136a1f15d28a3d4ca0be1c8157eda491609655ee965daffc

Score

10^/10

xloader dpzz loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

dpzz

Decoy

roadstown.com

idfaltd.com

infotechsearchgroup.com

elcuentodelaprincesa.com

youkutiyu88.com

wildparkresort.com

iss-sa.com

jmglaser.com

criticalthinking.store

cabinetsossa.com

satseconomy.com

newendtech.com

gran-piel.com

accoya.net

timothyschmallrealt.com

valentikaeventos.com

majestineprojector.com

love-austria.com

hermetikyogusmalikombi.com

karasevda-jor.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/752-63-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

e4c892aef5cc8a224af323c3ad222a50.exe

description pid process target process

PID 1480 set thread context of 752 1480 e4c892aef5cc8a224af323c3ad222a50.exe e4c892aef5cc8a224af323c3ad222a50.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e4c892aef5cc8a224af323c3ad222a50.exe

pid process

752 e4c892aef5cc8a224af323c3ad222a50.exe

description	pid	process	target process
PID 1480 set thread context of 752	1480	e4c892aef5cc8a224af323c3ad222a50.exe	e4c892aef5cc8a224af323c3ad222a50.exe

pid	process
752	e4c892aef5cc8a224af323c3ad222a50.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

e4c892aef5cc8a224af323c3ad222a50.exe

description	pid	process	target process
PID 1480 wrote to memory of 752	1480	e4c892aef5cc8a224af323c3ad222a50.exe	e4c892aef5cc8a224af323c3ad222a50.exe
PID 1480 wrote to memory of 752	1480	e4c892aef5cc8a224af323c3ad222a50.exe	e4c892aef5cc8a224af323c3ad222a50.exe
PID 1480 wrote to memory of 752	1480	e4c892aef5cc8a224af323c3ad222a50.exe	e4c892aef5cc8a224af323c3ad222a50.exe
PID 1480 wrote to memory of 752	1480	e4c892aef5cc8a224af323c3ad222a50.exe	e4c892aef5cc8a224af323c3ad222a50.exe
PID 1480 wrote to memory of 752	1480	e4c892aef5cc8a224af323c3ad222a50.exe	e4c892aef5cc8a224af323c3ad222a50.exe
PID 1480 wrote to memory of 752	1480	e4c892aef5cc8a224af323c3ad222a50.exe	e4c892aef5cc8a224af323c3ad222a50.exe
PID 1480 wrote to memory of 752	1480	e4c892aef5cc8a224af323c3ad222a50.exe	e4c892aef5cc8a224af323c3ad222a50.exe

C:\Users\Admin\AppData\Local\Temp\e4c892aef5cc8a224af323c3ad222a50.exe
"C:\Users\Admin\AppData\Local\Temp\e4c892aef5cc8a224af323c3ad222a50.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1480

C:\Users\Admin\AppData\Local\Temp\e4c892aef5cc8a224af323c3ad222a50.exe
"C:\Users\Admin\AppData\Local\Temp\e4c892aef5cc8a224af323c3ad222a50.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:752

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-61-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/752-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/752-63-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1480-55-0x0000000001350000-0x0000000001424000-memory.dmp

Filesize
848KB

Download
memory/1480-56-0x0000000074B21000-0x0000000074B23000-memory.dmp

Filesize
8KB

Download
memory/1480-57-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/1480-58-0x00000000004B0000-0x00000000004BE000-memory.dmp

Filesize
56KB

Download
memory/1480-59-0x000000007EF40000-0x000000007EF41000-memory.dmp

Filesize
4KB

Download
memory/1480-60-0x0000000005150000-0x00000000051FE000-memory.dmp

Filesize
696KB

Download

Analysis

Sharing