xloader | 757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad

General

Target

757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe
Size

43KB
MD5

7b5ad934e29d8d11c1ffed18a96cedd3
SHA1

68a2dc6dc49b56f25a662b5b24367fa1f4949a32
SHA256

757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad
SHA512

9d2d67536d3915c992b36cc5585cce52737d9309000ceee38a2a5cb6413922a9422e2d32adb65b97279f2ca2bed6e1ce04eeb738ab9c7eaf43506f58311d46dd

Score

10^/10

xloader ahc8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/4068-122-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Downloads MZ/PE file

Suspicious use of SetThreadContext 1 IoCs

Processes:

757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe

description	pid	process	target process
PID 4044 set thread context of 4068	4044	757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe	757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe

pid	process
4068	757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe
4068	757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe

description pid process

Token: SeDebugPrivilege 4044 757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe

description	pid	process
Token: SeDebugPrivilege	4044	757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe

description	pid	process	target process
PID 4044 wrote to memory of 4068	4044	757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe	757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe
PID 4044 wrote to memory of 4068	4044	757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe	757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe
PID 4044 wrote to memory of 4068	4044	757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe	757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe
PID 4044 wrote to memory of 4068	4044	757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe	757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe
PID 4044 wrote to memory of 4068	4044	757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe	757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe
PID 4044 wrote to memory of 4068	4044	757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe	757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe

C:\Users\Admin\AppData\Local\Temp\757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe
"C:\Users\Admin\AppData\Local\Temp\757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4044

C:\Users\Admin\AppData\Local\Temp\757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe
"C:\Users\Admin\AppData\Local\Temp\757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4044-114-0x0000000000D20000-0x0000000000D32000-memory.dmp

Filesize
72KB

Download
memory/4044-115-0x0000000005A20000-0x0000000005F1E000-memory.dmp

Filesize
5.0MB

Download
memory/4044-116-0x0000000073B1E000-0x0000000073B1F000-memory.dmp

Filesize
4KB

Download
memory/4044-117-0x00000000055C0000-0x0000000005652000-memory.dmp

Filesize
584KB

Download
memory/4044-118-0x0000000005570000-0x000000000557A000-memory.dmp

Filesize
40KB

Download
memory/4044-119-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/4044-120-0x00000000055A0000-0x00000000055BE000-memory.dmp

Filesize
120KB

Download
memory/4044-121-0x0000000006720000-0x00000000067BC000-memory.dmp

Filesize
624KB

Download
memory/4068-122-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4068-123-0x0000000001380000-0x00000000016A0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads