xloader | f5e1a753c6adb55fcc3eb64d7252f7c43ea1d4d5c33a63a5fa4373b3ca323f8c

General

Target

21fc8f1e8a50cfbc74f250310b3c71e9.exe
Size

379KB
MD5

21fc8f1e8a50cfbc74f250310b3c71e9
SHA1

e7cc0c94266d921bdfede53ad5aa8e1861851147
SHA256

f5e1a753c6adb55fcc3eb64d7252f7c43ea1d4d5c33a63a5fa4373b3ca323f8c
SHA512

31f878d6bb77d78e48beee80921d0da85c256ffa329dd9e63ebc8af34fedf38cd2091d2ede5ae63361036372ed82f07096bcb4092624962783c1b36b66ad89f7

Score

10^/10

xloader dpzz loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

dpzz

Decoy

roadstown.com

idfaltd.com

infotechsearchgroup.com

elcuentodelaprincesa.com

youkutiyu88.com

wildparkresort.com

iss-sa.com

jmglaser.com

criticalthinking.store

cabinetsossa.com

satseconomy.com

newendtech.com

gran-piel.com

accoya.net

timothyschmallrealt.com

valentikaeventos.com

majestineprojector.com

love-austria.com

hermetikyogusmalikombi.com

karasevda-jor.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3048-124-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

21fc8f1e8a50cfbc74f250310b3c71e9.exe

description pid process target process

PID 2492 set thread context of 3048 2492 21fc8f1e8a50cfbc74f250310b3c71e9.exe 21fc8f1e8a50cfbc74f250310b3c71e9.exe

description	pid	process	target process
PID 2492 set thread context of 3048	2492	21fc8f1e8a50cfbc74f250310b3c71e9.exe	21fc8f1e8a50cfbc74f250310b3c71e9.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

21fc8f1e8a50cfbc74f250310b3c71e9.exe21fc8f1e8a50cfbc74f250310b3c71e9.exe

pid	process
2492	21fc8f1e8a50cfbc74f250310b3c71e9.exe
2492	21fc8f1e8a50cfbc74f250310b3c71e9.exe
3048	21fc8f1e8a50cfbc74f250310b3c71e9.exe
3048	21fc8f1e8a50cfbc74f250310b3c71e9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

21fc8f1e8a50cfbc74f250310b3c71e9.exe

description pid process

Token: SeDebugPrivilege 2492 21fc8f1e8a50cfbc74f250310b3c71e9.exe

description	pid	process
Token: SeDebugPrivilege	2492	21fc8f1e8a50cfbc74f250310b3c71e9.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

21fc8f1e8a50cfbc74f250310b3c71e9.exe

description	pid	process	target process
PID 2492 wrote to memory of 1840	2492	21fc8f1e8a50cfbc74f250310b3c71e9.exe	21fc8f1e8a50cfbc74f250310b3c71e9.exe
PID 2492 wrote to memory of 1840	2492	21fc8f1e8a50cfbc74f250310b3c71e9.exe	21fc8f1e8a50cfbc74f250310b3c71e9.exe
PID 2492 wrote to memory of 1840	2492	21fc8f1e8a50cfbc74f250310b3c71e9.exe	21fc8f1e8a50cfbc74f250310b3c71e9.exe
PID 2492 wrote to memory of 3048	2492	21fc8f1e8a50cfbc74f250310b3c71e9.exe	21fc8f1e8a50cfbc74f250310b3c71e9.exe
PID 2492 wrote to memory of 3048	2492	21fc8f1e8a50cfbc74f250310b3c71e9.exe	21fc8f1e8a50cfbc74f250310b3c71e9.exe
PID 2492 wrote to memory of 3048	2492	21fc8f1e8a50cfbc74f250310b3c71e9.exe	21fc8f1e8a50cfbc74f250310b3c71e9.exe
PID 2492 wrote to memory of 3048	2492	21fc8f1e8a50cfbc74f250310b3c71e9.exe	21fc8f1e8a50cfbc74f250310b3c71e9.exe
PID 2492 wrote to memory of 3048	2492	21fc8f1e8a50cfbc74f250310b3c71e9.exe	21fc8f1e8a50cfbc74f250310b3c71e9.exe
PID 2492 wrote to memory of 3048	2492	21fc8f1e8a50cfbc74f250310b3c71e9.exe	21fc8f1e8a50cfbc74f250310b3c71e9.exe

C:\Users\Admin\AppData\Local\Temp\21fc8f1e8a50cfbc74f250310b3c71e9.exe
"C:\Users\Admin\AppData\Local\Temp\21fc8f1e8a50cfbc74f250310b3c71e9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492

C:\Users\Admin\AppData\Local\Temp\21fc8f1e8a50cfbc74f250310b3c71e9.exe
"C:\Users\Admin\AppData\Local\Temp\21fc8f1e8a50cfbc74f250310b3c71e9.exe"
2⤵
PID:1840

C:\Users\Admin\AppData\Local\Temp\21fc8f1e8a50cfbc74f250310b3c71e9.exe
"C:\Users\Admin\AppData\Local\Temp\21fc8f1e8a50cfbc74f250310b3c71e9.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3048

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2492-116-0x0000000000C00000-0x0000000000C66000-memory.dmp

Filesize
408KB

Download
memory/2492-117-0x0000000005AE0000-0x0000000005FDE000-memory.dmp

Filesize
5.0MB

Download
memory/2492-118-0x00000000055E0000-0x0000000005672000-memory.dmp

Filesize
584KB

Download
memory/2492-119-0x00000000055E0000-0x0000000005ADE000-memory.dmp

Filesize
5.0MB

Download
memory/2492-120-0x0000000005680000-0x000000000568A000-memory.dmp

Filesize
40KB

Download
memory/2492-121-0x0000000005820000-0x000000000582C000-memory.dmp

Filesize
48KB

Download
memory/2492-122-0x0000000007D10000-0x0000000007DAC000-memory.dmp

Filesize
624KB

Download
memory/2492-123-0x0000000007F90000-0x0000000007FF2000-memory.dmp

Filesize
392KB

Download
memory/3048-124-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3048-125-0x0000000001070000-0x0000000001390000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads