xloader | 943206c8028ed79aa0aafefa101ffa5d3034cf92b82f705556f12cf0a7eb5a5c

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-en-20211208
submitted
04/03/2022, 16:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vZnbpHVO9Ay3PKW.exe
Size 681KB
Sample220304-t78nwsfdd2
SHA256 943206c8028ed79aa0aafefa101ffa5d3034cf92b82f705556f12cf0a7eb5a5c
MD5 8e898565abe03640846bca9be730eac2
SHA1 bc2f5ec79debfac8f87fde09b0d9d72dac9b6f93
SHA512 3da0fdf32112684ed76bb316e1195a7537d807ad1968b388c672eba0f10f5c670699a1cb7313326872f60937c49d7215961268617f4a52c255c71f85a1e9a61a
MD5 SHA1 SHA512

Score

10^/10

xloader k8yh loader rat

Malware Config

Extracted

Family

xloader

Version

Campaign

k8yh

Decoy

lift2.cloud
tradeplay.net
familyattorneybg.com
accurbizlist.com
xrcasino.online
walletwriter.space
tiendasbioaseo.com
mrcandywholesale.com
multicoopltda.com
buylebsack.com
pilatesvilanova.com
fendoremi.com
vmfband.com
hrtaro.com
todosartenes.net
glusanka.info
dusa.codes
cfcfcs.xyz
ecostarsenergy.com
tokenbooze.com
3dvizscope.com
covenantarkal.com
magadethkult.net
gma-marineservices.com
streamgift9.info
zshhxx.com
discriminatorily.xyz
hxiemetals.com
theloansexperts.com
katarinapalushaj.com
greencity-college-club.com
tenlog062.xyz
librosyarteclub.com
fleuritionfloralandevents.com
walemiketalk.online
anariely.com
smutlinxxx.com
jcfim.com
sportssolutions.store
universityhelpworkshops.com
kbyt103.online
petronelli.group
gamingbd.pro
4kx.claims
eventdirective.com
atlanticpromotionsworldwide.com
mastercity.online
agrocet.com
dualipadenver.com
iepnewschool.com
myesthetic.club
betdivers.com
viviangreenenft.store
gratefulgangstas.com
dcfrc.com
chefscuderi.com
velvettask.com
korlad.com
19hawthornedrive166.com
zevklifoods.com
the-look-uae.com
financialservicesforyou.com
blauing.digital
stealameme.com
wanfengzp.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/540-66-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 736 set thread context of 540	736	vZnbpHVO9Ay3PKW.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1652	540	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
736	vZnbpHVO9Ay3PKW.exe
736	vZnbpHVO9Ay3PKW.exe
736	vZnbpHVO9Ay3PKW.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	736	vZnbpHVO9Ay3PKW.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 736 wrote to memory of 1124	736	vZnbpHVO9Ay3PKW.exe	27
PID 736 wrote to memory of 1124	736	vZnbpHVO9Ay3PKW.exe	27
PID 736 wrote to memory of 1124	736	vZnbpHVO9Ay3PKW.exe	27
PID 736 wrote to memory of 1124	736	vZnbpHVO9Ay3PKW.exe	27
PID 736 wrote to memory of 1124	736	vZnbpHVO9Ay3PKW.exe	27
PID 736 wrote to memory of 1124	736	vZnbpHVO9Ay3PKW.exe	27
PID 736 wrote to memory of 1124	736	vZnbpHVO9Ay3PKW.exe	27
PID 736 wrote to memory of 288	736	vZnbpHVO9Ay3PKW.exe	28
PID 736 wrote to memory of 288	736	vZnbpHVO9Ay3PKW.exe	28
PID 736 wrote to memory of 288	736	vZnbpHVO9Ay3PKW.exe	28
PID 736 wrote to memory of 288	736	vZnbpHVO9Ay3PKW.exe	28
PID 736 wrote to memory of 288	736	vZnbpHVO9Ay3PKW.exe	28
PID 736 wrote to memory of 288	736	vZnbpHVO9Ay3PKW.exe	28
PID 736 wrote to memory of 288	736	vZnbpHVO9Ay3PKW.exe	28
PID 736 wrote to memory of 540	736	vZnbpHVO9Ay3PKW.exe	29
PID 736 wrote to memory of 540	736	vZnbpHVO9Ay3PKW.exe	29
PID 736 wrote to memory of 540	736	vZnbpHVO9Ay3PKW.exe	29
PID 736 wrote to memory of 540	736	vZnbpHVO9Ay3PKW.exe	29
PID 736 wrote to memory of 540	736	vZnbpHVO9Ay3PKW.exe	29
PID 736 wrote to memory of 540	736	vZnbpHVO9Ay3PKW.exe	29
PID 736 wrote to memory of 540	736	vZnbpHVO9Ay3PKW.exe	29
PID 736 wrote to memory of 540	736	vZnbpHVO9Ay3PKW.exe	29
PID 736 wrote to memory of 540	736	vZnbpHVO9Ay3PKW.exe	29
PID 736 wrote to memory of 540	736	vZnbpHVO9Ay3PKW.exe	29
PID 540 wrote to memory of 1652	540	RegSvcs.exe	30
PID 540 wrote to memory of 1652	540	RegSvcs.exe	30
PID 540 wrote to memory of 1652	540	RegSvcs.exe	30
PID 540 wrote to memory of 1652	540	RegSvcs.exe	30

C:\Users\Admin\AppData\Local\Temp\vZnbpHVO9Ay3PKW.exe
"C:\Users\Admin\AppData\Local\Temp\vZnbpHVO9Ay3PKW.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  PID:1124
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  PID:288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 36
    3⤵
    - Program crash
    PID:1652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-62-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/540-64-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/540-66-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/736-55-0x0000000000CC0000-0x0000000000D70000-memory.dmp

Download

memory/736-56-0x0000000074C70000-0x000000007535E000-memory.dmp

Download

memory/736-57-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Download

memory/736-58-0x00000000005B0000-0x00000000005BA000-memory.dmp

Download

memory/736-59-0x000000007EF40000-0x000000007EF41000-memory.dmp

Download

memory/736-60-0x0000000005370000-0x00000000053F0000-memory.dmp

Download

memory/736-61-0x0000000000A20000-0x0000000000A50000-memory.dmp

Download