xloader | c7ceb2adec0ec0d5d01cbbc2753f0c2ddfc149c2e4daa47a519f44604ea5e557

Analysis

max time kernel
4294183s
max time network
125s
platform
windows7_x64
resource
win7-20220223-en
submitted
04-03-2022 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

15KB
MD5

40674110ecc6a402569f906e115d3d8b
SHA1

6771637dd6d3d89a9fd630f7b179d379b558bf77
SHA256

c7ceb2adec0ec0d5d01cbbc2753f0c2ddfc149c2e4daa47a519f44604ea5e557
SHA512

809c144a8418c0cd06ff365f51602000b2cc836d9cf49e8c9b2c394e1de9a61941cf461beec169d6837a2b29ad7aa70a936ddc59b9c1ea99e24efeae76bab018

Score

10^/10

xloader ahc8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1120-62-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Downloads MZ/PE file
Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp.exe

description pid process target process

PID 1940 set thread context of 1120 1940 tmp.exe tmp.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1440 1120 WerFault.exe tmp.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tmp.exe

description pid process

Token: SeDebugPrivilege 1940 tmp.exe

description	pid	process	target process
PID 1940 set thread context of 1120	1940	tmp.exe	tmp.exe

pid	pid_target	process	target process
1440	1120	WerFault.exe	tmp.exe

description	pid	process
Token: SeDebugPrivilege	1940	tmp.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

tmp.exetmp.exe

description	pid	process	target process
PID 1940 wrote to memory of 1120	1940	tmp.exe	tmp.exe
PID 1940 wrote to memory of 1120	1940	tmp.exe	tmp.exe
PID 1940 wrote to memory of 1120	1940	tmp.exe	tmp.exe
PID 1940 wrote to memory of 1120	1940	tmp.exe	tmp.exe
PID 1940 wrote to memory of 1120	1940	tmp.exe	tmp.exe
PID 1940 wrote to memory of 1120	1940	tmp.exe	tmp.exe
PID 1940 wrote to memory of 1120	1940	tmp.exe	tmp.exe
PID 1120 wrote to memory of 1440	1120	tmp.exe	WerFault.exe
PID 1120 wrote to memory of 1440	1120	tmp.exe	WerFault.exe
PID 1120 wrote to memory of 1440	1120	tmp.exe	WerFault.exe
PID 1120 wrote to memory of 1440	1120	tmp.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 36
3⤵
- Program crash
PID:1440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-58-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1120-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1120-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1940-54-0x0000000001010000-0x000000000101A000-memory.dmp

Filesize
40KB

Download
memory/1940-55-0x0000000074EB0000-0x000000007559E000-memory.dmp

Filesize
6.9MB

Download
memory/1940-56-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/1940-57-0x00000000008F0000-0x000000000090E000-memory.dmp

Filesize
120KB

Download