xloader | c9cdf462a12dc6e78757b7f1b3ad4fd9139cafd0b1e81d67d3d0141e2b09137e

General

Target

BANK INFORMATION-M0025012022-971332pdf.exe
Size

58KB
MD5

df12e9394a0b6fe9e3af1d48a7d77c7f
SHA1

e2dfa81e1dd7c50ff86506e09c60f3883bb37b7c
SHA256

c9cdf462a12dc6e78757b7f1b3ad4fd9139cafd0b1e81d67d3d0141e2b09137e
SHA512

6c58320b3fc059145d40e9fbb4d84762dfadd5871d392ad647e530e00e7f8db23220dca68358987ec70aedab9f237d40151fd3a8509701207ebb36c240a5e7d7

Score

10^/10

xloader be4o loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

be4o

Decoy

neonewway.club

kuanghong.club

7bkj.com

ooo-club.com

kamchatka-agency.com

sjsndtvitzru.mobi

noireimpactcollective.net

justbe-event.com

easypeasy.community

southcoast.glass

janhenningsen.com

jmxyjj.com

tarihibilet.com

nagradi7.com

percentrostered.net

certvaxid.com

kingseafoodsydney.com

blacksheepwalk.com

waktuk.com

inteligenciaenrefrigeracion.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/580-59-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/580-64-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1544-68-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Blocklisted process makes network request 1 IoCs

Processes:

cmd.exe

flow pid process

32 1544 cmd.exe

flow	pid	process
32	1544	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

BANK INFORMATION-M0025012022-971332pdf.exeaspnet_compiler.execmd.exe

description	pid	process	target process
PID 1628 set thread context of 580	1628	BANK INFORMATION-M0025012022-971332pdf.exe	aspnet_compiler.exe
PID 580 set thread context of 1376	580	aspnet_compiler.exe	Explorer.EXE
PID 580 set thread context of 1376	580	aspnet_compiler.exe	Explorer.EXE
PID 1544 set thread context of 1376	1544	cmd.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

aspnet_compiler.execmd.exe

pid	process
580	aspnet_compiler.exe
580	aspnet_compiler.exe
580	aspnet_compiler.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe
1544	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1376 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

aspnet_compiler.execmd.exe

pid process

580 aspnet_compiler.exe
580 aspnet_compiler.exe
580 aspnet_compiler.exe
580 aspnet_compiler.exe
1544 cmd.exe
1544 cmd.exe

pid	process
1376	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

BANK INFORMATION-M0025012022-971332pdf.exeaspnet_compiler.execmd.exe

description	pid	process
Token: SeDebugPrivilege	1628	BANK INFORMATION-M0025012022-971332pdf.exe
Token: SeDebugPrivilege	580	aspnet_compiler.exe
Token: SeDebugPrivilege	1544	cmd.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

BANK INFORMATION-M0025012022-971332pdf.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 1628 wrote to memory of 580	1628	BANK INFORMATION-M0025012022-971332pdf.exe	aspnet_compiler.exe
PID 1628 wrote to memory of 580	1628	BANK INFORMATION-M0025012022-971332pdf.exe	aspnet_compiler.exe
PID 1628 wrote to memory of 580	1628	BANK INFORMATION-M0025012022-971332pdf.exe	aspnet_compiler.exe
PID 1628 wrote to memory of 580	1628	BANK INFORMATION-M0025012022-971332pdf.exe	aspnet_compiler.exe
PID 1628 wrote to memory of 580	1628	BANK INFORMATION-M0025012022-971332pdf.exe	aspnet_compiler.exe
PID 1628 wrote to memory of 580	1628	BANK INFORMATION-M0025012022-971332pdf.exe	aspnet_compiler.exe
PID 1628 wrote to memory of 580	1628	BANK INFORMATION-M0025012022-971332pdf.exe	aspnet_compiler.exe
PID 1376 wrote to memory of 1544	1376	Explorer.EXE	cmd.exe
PID 1376 wrote to memory of 1544	1376	Explorer.EXE	cmd.exe
PID 1376 wrote to memory of 1544	1376	Explorer.EXE	cmd.exe
PID 1376 wrote to memory of 1544	1376	Explorer.EXE	cmd.exe
PID 1544 wrote to memory of 760	1544	cmd.exe	cmd.exe
PID 1544 wrote to memory of 760	1544	cmd.exe	cmd.exe
PID 1544 wrote to memory of 760	1544	cmd.exe	cmd.exe
PID 1544 wrote to memory of 760	1544	cmd.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1376

C:\Users\Admin\AppData\Local\Temp\BANK INFORMATION-M0025012022-971332pdf.exe
"C:\Users\Admin\AppData\Local\Temp\BANK INFORMATION-M0025012022-971332pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:580

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
3⤵
PID:760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-63-0x00000000001D0000-0x00000000001E1000-memory.dmp

Filesize
68KB

Download
memory/580-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/580-64-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/580-65-0x0000000000210000-0x0000000000221000-memory.dmp

Filesize
68KB

Download
memory/580-58-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/580-59-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/580-61-0x0000000000B70000-0x0000000000E73000-memory.dmp

Filesize
3.0MB

Download
memory/1376-62-0x0000000007110000-0x0000000007286000-memory.dmp

Filesize
1.5MB

Download
memory/1376-71-0x0000000004A20000-0x0000000004AE4000-memory.dmp

Filesize
784KB

Download
memory/1376-66-0x00000000073A0000-0x000000000750B000-memory.dmp

Filesize
1.4MB

Download
memory/1544-68-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/1544-67-0x000000004A920000-0x000000004A96C000-memory.dmp

Filesize
304KB

Download
memory/1544-69-0x0000000001FC0000-0x00000000022C3000-memory.dmp

Filesize
3.0MB

Download
memory/1544-70-0x00000000003D0000-0x0000000000460000-memory.dmp

Filesize
576KB

Download
memory/1544-72-0x00000000751B1000-0x00000000751B3000-memory.dmp

Filesize
8KB

Download
memory/1628-56-0x0000000000840000-0x0000000000856000-memory.dmp

Filesize
88KB

Download
memory/1628-55-0x000000001BE60000-0x000000001BE62000-memory.dmp

Filesize
8KB

Download
memory/1628-54-0x000000013FE30000-0x000000013FE42000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads