xloader | c7a495508b1d56372df84c2cad44b99b65db360c0c31d409fe14d91eacf9072a

General

Target

transferir copia_03_05.exe
Size

823KB
MD5

4f1a54809ac8e534239bade40b46bfab
SHA1

cc4ae9e1888fa1071fcccc56f8e46253bd00b99a
SHA256

3488d309b21afbc3b481320bcf1209908813e2eb8a63df772f740426034b9958
SHA512

d13542d590ec6482f6c0bbbbf6d504f39c64fd28f8e32ebb239a33193c0afe4cd4e938ca6a966e115aeaa92e21b0581d32cf8a736e764d66b237d573e303a705

Score

10^/10

xloader 8zdn loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

8zdn

Decoy

yourherogarden.net

onlineharambee.net

cerrajeriaurgencias24horas.com

distritoforex.com

verifyclientserverssr.com

dandwg.com

co2-zero.global

joshssl.com

meckwt.com

theammf.com

rawclectic.com

gzgnetwork.com

richmondavenuecoc.com

nicolelyte.com

thetinyclosetboutique.com

llt-group.net

seven-sky-design.com

joganifinancialgrp.com

elementsvapes.com

bingent.info

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1404-61-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/1628-67-0x00000000000C0000-0x00000000000E8000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

384 cmd.exe

pid	process
384	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

transferir copia_03_05.exetransferir copia_03_05.exesystray.exe

description	pid	process	target process
PID 1304 set thread context of 1404	1304	transferir copia_03_05.exe	transferir copia_03_05.exe
PID 1404 set thread context of 1412	1404	transferir copia_03_05.exe	Explorer.EXE
PID 1628 set thread context of 1412	1628	systray.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

transferir copia_03_05.exesystray.exe

pid	process
1404	transferir copia_03_05.exe
1404	transferir copia_03_05.exe
1628	systray.exe
1628	systray.exe
1628	systray.exe
1628	systray.exe
1628	systray.exe
1628	systray.exe
1628	systray.exe
1628	systray.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

transferir copia_03_05.exesystray.exe

pid process

1404 transferir copia_03_05.exe
1404 transferir copia_03_05.exe
1404 transferir copia_03_05.exe
1628 systray.exe
1628 systray.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

transferir copia_03_05.exesystray.exe

description pid process

Token: SeDebugPrivilege 1404 transferir copia_03_05.exe
Token: SeDebugPrivilege 1628 systray.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1412 Explorer.EXE
1412 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1412 Explorer.EXE
1412 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1404	transferir copia_03_05.exe
Token: SeDebugPrivilege	1628	systray.exe

pid	process
1412	Explorer.EXE
1412	Explorer.EXE

pid	process
1412	Explorer.EXE
1412	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

transferir copia_03_05.exeExplorer.EXEsystray.exe

description	pid	process	target process
PID 1304 wrote to memory of 1404	1304	transferir copia_03_05.exe	transferir copia_03_05.exe
PID 1304 wrote to memory of 1404	1304	transferir copia_03_05.exe	transferir copia_03_05.exe
PID 1304 wrote to memory of 1404	1304	transferir copia_03_05.exe	transferir copia_03_05.exe
PID 1304 wrote to memory of 1404	1304	transferir copia_03_05.exe	transferir copia_03_05.exe
PID 1304 wrote to memory of 1404	1304	transferir copia_03_05.exe	transferir copia_03_05.exe
PID 1304 wrote to memory of 1404	1304	transferir copia_03_05.exe	transferir copia_03_05.exe
PID 1304 wrote to memory of 1404	1304	transferir copia_03_05.exe	transferir copia_03_05.exe
PID 1412 wrote to memory of 1628	1412	Explorer.EXE	systray.exe
PID 1412 wrote to memory of 1628	1412	Explorer.EXE	systray.exe
PID 1412 wrote to memory of 1628	1412	Explorer.EXE	systray.exe
PID 1412 wrote to memory of 1628	1412	Explorer.EXE	systray.exe
PID 1628 wrote to memory of 384	1628	systray.exe	cmd.exe
PID 1628 wrote to memory of 384	1628	systray.exe	cmd.exe
PID 1628 wrote to memory of 384	1628	systray.exe	cmd.exe
PID 1628 wrote to memory of 384	1628	systray.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1412

C:\Users\Admin\AppData\Local\Temp\transferir copia_03_05.exe
"C:\Users\Admin\AppData\Local\Temp\transferir copia_03_05.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1304

C:\Users\Admin\AppData\Local\Temp\transferir copia_03_05.exe
"C:\Users\Admin\AppData\Local\Temp\transferir copia_03_05.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Windows\SysWOW64\systray.exe
"C:\Windows\SysWOW64\systray.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\transferir copia_03_05.exe"
3⤵
- Deletes itself
PID:384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1304-54-0x0000000001120000-0x00000000011F4000-memory.dmp

Filesize
848KB

Download
memory/1304-55-0x0000000076921000-0x0000000076923000-memory.dmp

Filesize
8KB

Download
memory/1304-56-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/1304-57-0x0000000000310000-0x000000000031E000-memory.dmp

Filesize
56KB

Download
memory/1304-58-0x0000000000F20000-0x0000000000F76000-memory.dmp

Filesize
344KB

Download
memory/1404-64-0x0000000000160000-0x0000000000170000-memory.dmp

Filesize
64KB

Download
memory/1404-60-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1404-61-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1404-59-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1404-63-0x00000000008B0000-0x0000000000BB3000-memory.dmp

Filesize
3.0MB

Download
memory/1412-65-0x00000000067D0000-0x0000000006891000-memory.dmp

Filesize
772KB

Download
memory/1412-70-0x0000000009B10000-0x0000000009C99000-memory.dmp

Filesize
1.5MB

Download
memory/1628-66-0x0000000000770000-0x0000000000775000-memory.dmp

Filesize
20KB

Download
memory/1628-67-0x00000000000C0000-0x00000000000E8000-memory.dmp

Filesize
160KB

Download
memory/1628-68-0x0000000001E50000-0x0000000002153000-memory.dmp

Filesize
3.0MB

Download
memory/1628-69-0x0000000001CE0000-0x0000000001D6F000-memory.dmp

Filesize
572KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads