xloader | e8232a6b14f66804622f2ea2bfd8c2d8bfe5eef292f664c5801844b96a84d125

Analysis

max time kernel
7s
max time network
14s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
03-02-2022 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Shipping Documents.exe
Size

664KB
MD5

c35e97b32cab03a7fea48ccc3fb716b8
SHA1

4b173de88a0bff2a405d37f0f59e222b9525c5a3
SHA256

e8232a6b14f66804622f2ea2bfd8c2d8bfe5eef292f664c5801844b96a84d125
SHA512

b1cacbfd4c2153d7b1adee03d5a3b72ca586df8aee48b2c0c7e08e0f039dda497eb67c7d0ac810c81112b4cfcd1b41da47a48d9308b088d60688a4815abd7071

Score

10^/10

xloader zqzw loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

zqzw

Decoy

laurentmathieu.com

nohohonndana.com

hhmc.info

shophallows.com

blazebunk.com

goodbridge.xyz

flakycloud.com

bakermckenziegroups.com

formation-adistance.com

lovingearthbotanicals.com

tbrservice.plus

heritagehousehotels.com

drwbuildersco.com

lacsghb.com

wain3x.com

dadreview.club

continiutycp.com

cockgirls.com

48mpt.xyz

033skz.xyz

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4060-131-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

Shipping Documents.exe

description pid process target process

PID 1412 set thread context of 4060 1412 Shipping Documents.exe aspnet_compiler.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Shipping Documents.exe

description pid process

Token: SeDebugPrivilege 1412 Shipping Documents.exe

description	pid	process	target process
PID 1412 set thread context of 4060	1412	Shipping Documents.exe	aspnet_compiler.exe

description	pid	process
Token: SeDebugPrivilege	1412	Shipping Documents.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Shipping Documents.exe

description	pid	process	target process
PID 1412 wrote to memory of 4060	1412	Shipping Documents.exe	aspnet_compiler.exe
PID 1412 wrote to memory of 4060	1412	Shipping Documents.exe	aspnet_compiler.exe
PID 1412 wrote to memory of 4060	1412	Shipping Documents.exe	aspnet_compiler.exe
PID 1412 wrote to memory of 4060	1412	Shipping Documents.exe	aspnet_compiler.exe
PID 1412 wrote to memory of 4060	1412	Shipping Documents.exe	aspnet_compiler.exe
PID 1412 wrote to memory of 4060	1412	Shipping Documents.exe	aspnet_compiler.exe

C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:4060

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1412-130-0x00000000005B0000-0x000000000065C000-memory.dmp

Filesize
688KB

Download
memory/4060-131-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download