xloader | c7ceb2adec0ec0d5d01cbbc2753f0c2ddfc149c2e4daa47a519f44604ea5e557

General

Target

40674110ecc6a402569f906e115d3d8b.exe
Size

15KB
MD5

40674110ecc6a402569f906e115d3d8b
SHA1

6771637dd6d3d89a9fd630f7b179d379b558bf77
SHA256

c7ceb2adec0ec0d5d01cbbc2753f0c2ddfc149c2e4daa47a519f44604ea5e557
SHA512

809c144a8418c0cd06ff365f51602000b2cc836d9cf49e8c9b2c394e1de9a61941cf461beec169d6837a2b29ad7aa70a936ddc59b9c1ea99e24efeae76bab018

Score

10^/10

xloader ahc8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1628-141-0x0000000000160000-0x0000000000189000-memory.dmp	xloader

Downloads MZ/PE file
Suspicious use of SetThreadContext 1 IoCs

Processes:

40674110ecc6a402569f906e115d3d8b.exe

description pid process target process

PID 212 set thread context of 1628 212 40674110ecc6a402569f906e115d3d8b.exe 40674110ecc6a402569f906e115d3d8b.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2640 1628 WerFault.exe 40674110ecc6a402569f906e115d3d8b.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

40674110ecc6a402569f906e115d3d8b.exe

description pid process

Token: SeDebugPrivilege 212 40674110ecc6a402569f906e115d3d8b.exe

description	pid	process	target process
PID 212 set thread context of 1628	212	40674110ecc6a402569f906e115d3d8b.exe	40674110ecc6a402569f906e115d3d8b.exe

pid	pid_target	process	target process
2640	1628	WerFault.exe	40674110ecc6a402569f906e115d3d8b.exe

description	pid	process
Token: SeDebugPrivilege	212	40674110ecc6a402569f906e115d3d8b.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

40674110ecc6a402569f906e115d3d8b.exe

description	pid	process	target process
PID 212 wrote to memory of 1628	212	40674110ecc6a402569f906e115d3d8b.exe	40674110ecc6a402569f906e115d3d8b.exe
PID 212 wrote to memory of 1628	212	40674110ecc6a402569f906e115d3d8b.exe	40674110ecc6a402569f906e115d3d8b.exe
PID 212 wrote to memory of 1628	212	40674110ecc6a402569f906e115d3d8b.exe	40674110ecc6a402569f906e115d3d8b.exe
PID 212 wrote to memory of 1628	212	40674110ecc6a402569f906e115d3d8b.exe	40674110ecc6a402569f906e115d3d8b.exe
PID 212 wrote to memory of 1628	212	40674110ecc6a402569f906e115d3d8b.exe	40674110ecc6a402569f906e115d3d8b.exe
PID 212 wrote to memory of 1628	212	40674110ecc6a402569f906e115d3d8b.exe	40674110ecc6a402569f906e115d3d8b.exe

C:\Users\Admin\AppData\Local\Temp\40674110ecc6a402569f906e115d3d8b.exe
"C:\Users\Admin\AppData\Local\Temp\40674110ecc6a402569f906e115d3d8b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:212

C:\Users\Admin\AppData\Local\Temp\40674110ecc6a402569f906e115d3d8b.exe
"C:\Users\Admin\AppData\Local\Temp\40674110ecc6a402569f906e115d3d8b.exe"
2⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 184
3⤵
- Program crash
PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1628 -ip 1628
1⤵
PID:1232

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/212-133-0x0000000000AC0000-0x0000000000ACA000-memory.dmp

Filesize
40KB

Download
memory/212-134-0x00000000744E0000-0x0000000074C90000-memory.dmp

Filesize
7.7MB

Download
memory/212-135-0x00000000059D0000-0x0000000005F74000-memory.dmp

Filesize
5.6MB

Download
memory/212-136-0x00000000054C0000-0x0000000005552000-memory.dmp

Filesize
584KB

Download
memory/212-137-0x0000000005480000-0x000000000548A000-memory.dmp

Filesize
40KB

Download
memory/212-138-0x0000000005420000-0x00000000059C4000-memory.dmp

Filesize
5.6MB

Download
memory/212-139-0x0000000006A10000-0x0000000006AAC000-memory.dmp

Filesize
624KB

Download
memory/1628-141-0x0000000000160000-0x0000000000189000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing