xloader | 757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad

General

Target

7b5ad934e29d8d11c1ffed18a96cedd3.exe
Size

43KB
MD5

7b5ad934e29d8d11c1ffed18a96cedd3
SHA1

68a2dc6dc49b56f25a662b5b24367fa1f4949a32
SHA256

757cd8cf8e9d17c61a1f5308d75ff5eae936d15f25fac859f8731b0e7030d4ad
SHA512

9d2d67536d3915c992b36cc5585cce52737d9309000ceee38a2a5cb6413922a9422e2d32adb65b97279f2ca2bed6e1ce04eeb738ab9c7eaf43506f58311d46dd

Score

10^/10

xloader ahc8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1512-60-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Downloads MZ/PE file
Suspicious use of SetThreadContext 1 IoCs

Processes:

7b5ad934e29d8d11c1ffed18a96cedd3.exe

description pid process target process

PID 1712 set thread context of 1512 1712 7b5ad934e29d8d11c1ffed18a96cedd3.exe 7b5ad934e29d8d11c1ffed18a96cedd3.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

7b5ad934e29d8d11c1ffed18a96cedd3.exe

pid process

1512 7b5ad934e29d8d11c1ffed18a96cedd3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7b5ad934e29d8d11c1ffed18a96cedd3.exe

description pid process

Token: SeDebugPrivilege 1712 7b5ad934e29d8d11c1ffed18a96cedd3.exe

description	pid	process	target process
PID 1712 set thread context of 1512	1712	7b5ad934e29d8d11c1ffed18a96cedd3.exe	7b5ad934e29d8d11c1ffed18a96cedd3.exe

pid	process
1512	7b5ad934e29d8d11c1ffed18a96cedd3.exe

description	pid	process
Token: SeDebugPrivilege	1712	7b5ad934e29d8d11c1ffed18a96cedd3.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

7b5ad934e29d8d11c1ffed18a96cedd3.exe

description	pid	process	target process
PID 1712 wrote to memory of 1512	1712	7b5ad934e29d8d11c1ffed18a96cedd3.exe	7b5ad934e29d8d11c1ffed18a96cedd3.exe
PID 1712 wrote to memory of 1512	1712	7b5ad934e29d8d11c1ffed18a96cedd3.exe	7b5ad934e29d8d11c1ffed18a96cedd3.exe
PID 1712 wrote to memory of 1512	1712	7b5ad934e29d8d11c1ffed18a96cedd3.exe	7b5ad934e29d8d11c1ffed18a96cedd3.exe
PID 1712 wrote to memory of 1512	1712	7b5ad934e29d8d11c1ffed18a96cedd3.exe	7b5ad934e29d8d11c1ffed18a96cedd3.exe
PID 1712 wrote to memory of 1512	1712	7b5ad934e29d8d11c1ffed18a96cedd3.exe	7b5ad934e29d8d11c1ffed18a96cedd3.exe
PID 1712 wrote to memory of 1512	1712	7b5ad934e29d8d11c1ffed18a96cedd3.exe	7b5ad934e29d8d11c1ffed18a96cedd3.exe
PID 1712 wrote to memory of 1512	1712	7b5ad934e29d8d11c1ffed18a96cedd3.exe	7b5ad934e29d8d11c1ffed18a96cedd3.exe

C:\Users\Admin\AppData\Local\Temp\7b5ad934e29d8d11c1ffed18a96cedd3.exe
"C:\Users\Admin\AppData\Local\Temp\7b5ad934e29d8d11c1ffed18a96cedd3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712

C:\Users\Admin\AppData\Local\Temp\7b5ad934e29d8d11c1ffed18a96cedd3.exe
"C:\Users\Admin\AppData\Local\Temp\7b5ad934e29d8d11c1ffed18a96cedd3.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-58-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1512-59-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1512-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1512-61-0x0000000000880000-0x0000000000B83000-memory.dmp

Filesize
3.0MB

Download
memory/1712-54-0x0000000001000000-0x0000000001012000-memory.dmp

Filesize
72KB

Download
memory/1712-55-0x000000007404E000-0x000000007404F000-memory.dmp

Filesize
4KB

Download
memory/1712-56-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/1712-57-0x00000000008F0000-0x000000000090E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing