xloader | c9cdf462a12dc6e78757b7f1b3ad4fd9139cafd0b1e81d67d3d0141e2b09137e

General

Target

BANK INFORMATION-M0025012022-971332pdf.exe
Size

58KB
MD5

df12e9394a0b6fe9e3af1d48a7d77c7f
SHA1

e2dfa81e1dd7c50ff86506e09c60f3883bb37b7c
SHA256

c9cdf462a12dc6e78757b7f1b3ad4fd9139cafd0b1e81d67d3d0141e2b09137e
SHA512

6c58320b3fc059145d40e9fbb4d84762dfadd5871d392ad647e530e00e7f8db23220dca68358987ec70aedab9f237d40151fd3a8509701207ebb36c240a5e7d7

Score

10^/10

xloader be4o loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

be4o

Decoy

neonewway.club

kuanghong.club

7bkj.com

ooo-club.com

kamchatka-agency.com

sjsndtvitzru.mobi

noireimpactcollective.net

justbe-event.com

easypeasy.community

southcoast.glass

janhenningsen.com

jmxyjj.com

tarihibilet.com

nagradi7.com

percentrostered.net

certvaxid.com

kingseafoodsydney.com

blacksheepwalk.com

waktuk.com

inteligenciaenrefrigeracion.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3756-118-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/3756-123-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/1320-127-0x0000000000370000-0x0000000000399000-memory.dmp	xloader

Suspicious use of SetThreadContext 4 IoCs

Processes:

BANK INFORMATION-M0025012022-971332pdf.exeaspnet_compiler.execmstp.exe

description	pid	process	target process
PID 2400 set thread context of 3756	2400	BANK INFORMATION-M0025012022-971332pdf.exe	aspnet_compiler.exe
PID 3756 set thread context of 3024	3756	aspnet_compiler.exe	Explorer.EXE
PID 3756 set thread context of 3024	3756	aspnet_compiler.exe	Explorer.EXE
PID 1320 set thread context of 3024	1320	cmstp.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 56 IoCs

Processes:

aspnet_compiler.execmstp.exe

pid	process
3756	aspnet_compiler.exe
3756	aspnet_compiler.exe
3756	aspnet_compiler.exe
3756	aspnet_compiler.exe
3756	aspnet_compiler.exe
3756	aspnet_compiler.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe
1320	cmstp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3024 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

aspnet_compiler.execmstp.exe

pid process

3756 aspnet_compiler.exe
3756 aspnet_compiler.exe
3756 aspnet_compiler.exe
3756 aspnet_compiler.exe
1320 cmstp.exe
1320 cmstp.exe

pid	process
3024	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

BANK INFORMATION-M0025012022-971332pdf.exeaspnet_compiler.execmstp.exe

description	pid	process
Token: SeDebugPrivilege	2400	BANK INFORMATION-M0025012022-971332pdf.exe
Token: SeDebugPrivilege	3756	aspnet_compiler.exe
Token: SeDebugPrivilege	1320	cmstp.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

BANK INFORMATION-M0025012022-971332pdf.exeaspnet_compiler.execmstp.exe

description	pid	process	target process
PID 2400 wrote to memory of 3756	2400	BANK INFORMATION-M0025012022-971332pdf.exe	aspnet_compiler.exe
PID 2400 wrote to memory of 3756	2400	BANK INFORMATION-M0025012022-971332pdf.exe	aspnet_compiler.exe
PID 2400 wrote to memory of 3756	2400	BANK INFORMATION-M0025012022-971332pdf.exe	aspnet_compiler.exe
PID 2400 wrote to memory of 3756	2400	BANK INFORMATION-M0025012022-971332pdf.exe	aspnet_compiler.exe
PID 2400 wrote to memory of 3756	2400	BANK INFORMATION-M0025012022-971332pdf.exe	aspnet_compiler.exe
PID 2400 wrote to memory of 3756	2400	BANK INFORMATION-M0025012022-971332pdf.exe	aspnet_compiler.exe
PID 3756 wrote to memory of 1320	3756	aspnet_compiler.exe	cmstp.exe
PID 3756 wrote to memory of 1320	3756	aspnet_compiler.exe	cmstp.exe
PID 3756 wrote to memory of 1320	3756	aspnet_compiler.exe	cmstp.exe
PID 1320 wrote to memory of 1536	1320	cmstp.exe	cmd.exe
PID 1320 wrote to memory of 1536	1320	cmstp.exe	cmd.exe
PID 1320 wrote to memory of 1536	1320	cmstp.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3024

C:\Users\Admin\AppData\Local\Temp\BANK INFORMATION-M0025012022-971332pdf.exe
"C:\Users\Admin\AppData\Local\Temp\BANK INFORMATION-M0025012022-971332pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3756

C:\Windows\SysWOW64\cmstp.exe
"C:\Windows\SysWOW64\cmstp.exe"
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
5⤵
PID:1536

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:3732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-129-0x00000000042C0000-0x0000000004452000-memory.dmp

Filesize
1.6MB

Download
memory/1320-127-0x0000000000370000-0x0000000000399000-memory.dmp

Filesize
164KB

Download
memory/1320-128-0x0000000004600000-0x0000000004920000-memory.dmp

Filesize
3.1MB

Download
memory/1320-126-0x0000000000D10000-0x0000000000D26000-memory.dmp

Filesize
88KB

Download
memory/2400-115-0x0000000000C60000-0x0000000000C72000-memory.dmp

Filesize
72KB

Download
memory/2400-116-0x0000000003720000-0x0000000003722000-memory.dmp

Filesize
8KB

Download
memory/2400-117-0x00000000014B0000-0x00000000014C6000-memory.dmp

Filesize
88KB

Download
memory/3024-125-0x0000000002F50000-0x000000000301C000-memory.dmp

Filesize
816KB

Download
memory/3024-122-0x0000000006510000-0x000000000662A000-memory.dmp

Filesize
1.1MB

Download
memory/3024-130-0x0000000006630000-0x000000000677E000-memory.dmp

Filesize
1.3MB

Download
memory/3756-124-0x0000000003370000-0x0000000003381000-memory.dmp

Filesize
68KB

Download
memory/3756-123-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3756-121-0x0000000001030000-0x00000000019C0000-memory.dmp

Filesize
9.6MB

Download
memory/3756-120-0x0000000001530000-0x0000000001850000-memory.dmp

Filesize
3.1MB

Download
memory/3756-118-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads