xloader | aad3d2ac3b190920fd8eac3aa73f6aa205d002a14421abafb2c51b13a73b6e37

General

Target

SKC360I2.exe
Size

509KB
MD5

196b7f181400d2e97eb9579059cc900c
SHA1

4db7ff3d766b0fb98a6c70a4272aaf71a1a60180
SHA256

9343e815779a3b9b9520e1f781b89a20d1a7a961e56cb98e266880b7ab9e8f93
SHA512

e64427df89db6a971c453ad481477e78632732c3ca7b1b544324fc9ccb1e00a6d830879ff0408adefeff7f28cd5e3308f4c3f2a34f34a3e2334080de8489d6fa

Score

10^/10

xloader u0n0 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

u0n0

Decoy

learnwithvr.net

minismi2.com

slimfitbottle.com

gzartisan.com

fullfamilyclub.com

adaptationstudios.com

domynt.com

aboydnfuid.com

dirtroaddesigns.net

timhortons-ca.xyz

gladiator-111.com

breakingza.com

njjbds.com

keithrgordon.com

litestore365.host

unichromegame.com

wundversorgung-tirol.com

wholistic-choice.com

shingletownrrn.com

kapikenya.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1220-61-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1220-63-0x00000000007F0000-0x0000000000BF3000-memory.dmp	xloader
behavioral1/memory/1792-69-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1496 cmd.exe

pid	process
1496	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

SKC360I2.exeSKC360I2.execolorcpl.exe

description	pid	process	target process
PID 848 set thread context of 1220	848	SKC360I2.exe	SKC360I2.exe
PID 1220 set thread context of 1376	1220	SKC360I2.exe	Explorer.EXE
PID 1792 set thread context of 1376	1792	colorcpl.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

SKC360I2.exeSKC360I2.execolorcpl.exe

pid	process
848	SKC360I2.exe
1220	SKC360I2.exe
1220	SKC360I2.exe
1792	colorcpl.exe
1792	colorcpl.exe
1792	colorcpl.exe
1792	colorcpl.exe
1792	colorcpl.exe
1792	colorcpl.exe
1792	colorcpl.exe
1792	colorcpl.exe
1792	colorcpl.exe
1792	colorcpl.exe
1792	colorcpl.exe
1792	colorcpl.exe
1792	colorcpl.exe
1792	colorcpl.exe
1792	colorcpl.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

SKC360I2.execolorcpl.exe

pid process

1220 SKC360I2.exe
1220 SKC360I2.exe
1220 SKC360I2.exe
1792 colorcpl.exe
1792 colorcpl.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

SKC360I2.exeSKC360I2.execolorcpl.exe

description pid process

Token: SeDebugPrivilege 848 SKC360I2.exe
Token: SeDebugPrivilege 1220 SKC360I2.exe
Token: SeDebugPrivilege 1792 colorcpl.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1376 Explorer.EXE
1376 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1376 Explorer.EXE
1376 Explorer.EXE

pid	process
1220	SKC360I2.exe
1220	SKC360I2.exe
1220	SKC360I2.exe
1792	colorcpl.exe
1792	colorcpl.exe

description	pid	process
Token: SeDebugPrivilege	848	SKC360I2.exe
Token: SeDebugPrivilege	1220	SKC360I2.exe
Token: SeDebugPrivilege	1792	colorcpl.exe

pid	process
1376	Explorer.EXE
1376	Explorer.EXE

pid	process
1376	Explorer.EXE
1376	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

SKC360I2.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 848 wrote to memory of 892	848	SKC360I2.exe	SKC360I2.exe
PID 848 wrote to memory of 892	848	SKC360I2.exe	SKC360I2.exe
PID 848 wrote to memory of 892	848	SKC360I2.exe	SKC360I2.exe
PID 848 wrote to memory of 892	848	SKC360I2.exe	SKC360I2.exe
PID 848 wrote to memory of 1220	848	SKC360I2.exe	SKC360I2.exe
PID 848 wrote to memory of 1220	848	SKC360I2.exe	SKC360I2.exe
PID 848 wrote to memory of 1220	848	SKC360I2.exe	SKC360I2.exe
PID 848 wrote to memory of 1220	848	SKC360I2.exe	SKC360I2.exe
PID 848 wrote to memory of 1220	848	SKC360I2.exe	SKC360I2.exe
PID 848 wrote to memory of 1220	848	SKC360I2.exe	SKC360I2.exe
PID 848 wrote to memory of 1220	848	SKC360I2.exe	SKC360I2.exe
PID 1376 wrote to memory of 1792	1376	Explorer.EXE	colorcpl.exe
PID 1376 wrote to memory of 1792	1376	Explorer.EXE	colorcpl.exe
PID 1376 wrote to memory of 1792	1376	Explorer.EXE	colorcpl.exe
PID 1376 wrote to memory of 1792	1376	Explorer.EXE	colorcpl.exe
PID 1792 wrote to memory of 1496	1792	colorcpl.exe	cmd.exe
PID 1792 wrote to memory of 1496	1792	colorcpl.exe	cmd.exe
PID 1792 wrote to memory of 1496	1792	colorcpl.exe	cmd.exe
PID 1792 wrote to memory of 1496	1792	colorcpl.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1376

C:\Users\Admin\AppData\Local\Temp\SKC360I2.exe
"C:\Users\Admin\AppData\Local\Temp\SKC360I2.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848

C:\Users\Admin\AppData\Local\Temp\SKC360I2.exe
"C:\Users\Admin\AppData\Local\Temp\SKC360I2.exe"
3⤵
PID:892

C:\Users\Admin\AppData\Local\Temp\SKC360I2.exe
"C:\Users\Admin\AppData\Local\Temp\SKC360I2.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\SKC360I2.exe"
3⤵
- Deletes itself
PID:1496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-54-0x00000000000F0000-0x0000000000174000-memory.dmp

Filesize
528KB

Download
memory/848-55-0x00000000751B1000-0x00000000751B3000-memory.dmp

Filesize
8KB

Download
memory/848-56-0x0000000002030000-0x0000000002031000-memory.dmp

Filesize
4KB

Download
memory/848-57-0x0000000000610000-0x000000000061C000-memory.dmp

Filesize
48KB

Download
memory/848-58-0x0000000004830000-0x0000000004880000-memory.dmp

Filesize
320KB

Download
memory/1220-63-0x00000000007F0000-0x0000000000BF3000-memory.dmp

Filesize
4.0MB

Download
memory/1220-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1220-61-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1220-59-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1220-64-0x0000000000360000-0x0000000000371000-memory.dmp

Filesize
68KB

Download
memory/1376-65-0x0000000004AF0000-0x0000000004BBB000-memory.dmp

Filesize
812KB

Download
memory/1376-71-0x0000000004FC0000-0x0000000005054000-memory.dmp

Filesize
592KB

Download
memory/1792-67-0x0000000000BE0000-0x0000000000BF8000-memory.dmp

Filesize
96KB

Download
memory/1792-68-0x0000000002000000-0x0000000002303000-memory.dmp

Filesize
3.0MB

Download
memory/1792-69-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/1792-70-0x00000000008B0000-0x0000000000940000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads