xloader | c7ceb2adec0ec0d5d01cbbc2753f0c2ddfc149c2e4daa47a519f44604ea5e557

Analysis

max time kernel
129s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
04-03-2022 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

15KB
MD5

40674110ecc6a402569f906e115d3d8b
SHA1

6771637dd6d3d89a9fd630f7b179d379b558bf77
SHA256

c7ceb2adec0ec0d5d01cbbc2753f0c2ddfc149c2e4daa47a519f44604ea5e557
SHA512

809c144a8418c0cd06ff365f51602000b2cc836d9cf49e8c9b2c394e1de9a61941cf461beec169d6837a2b29ad7aa70a936ddc59b9c1ea99e24efeae76bab018

Score

10^/10

xloader ahc8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4548-138-0x0000000000760000-0x0000000000789000-memory.dmp	xloader

Downloads MZ/PE file
Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp.exe

description pid process target process

PID 4560 set thread context of 4548 4560 tmp.exe tmp.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1708 4548 WerFault.exe tmp.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tmp.exe

description pid process

Token: SeDebugPrivilege 4560 tmp.exe

description	pid	process	target process
PID 4560 set thread context of 4548	4560	tmp.exe	tmp.exe

pid	pid_target	process	target process
1708	4548	WerFault.exe	tmp.exe

description	pid	process
Token: SeDebugPrivilege	4560	tmp.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 4560 wrote to memory of 4548	4560	tmp.exe	tmp.exe
PID 4560 wrote to memory of 4548	4560	tmp.exe	tmp.exe
PID 4560 wrote to memory of 4548	4560	tmp.exe	tmp.exe
PID 4560 wrote to memory of 4548	4560	tmp.exe	tmp.exe
PID 4560 wrote to memory of 4548	4560	tmp.exe	tmp.exe
PID 4560 wrote to memory of 4548	4560	tmp.exe	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 184
3⤵
- Program crash
PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4548 -ip 4548
1⤵
PID:4824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4548-138-0x0000000000760000-0x0000000000789000-memory.dmp

Filesize
164KB

Download
memory/4560-130-0x0000000000B60000-0x0000000000B6A000-memory.dmp

Filesize
40KB

Download
memory/4560-131-0x0000000075110000-0x00000000758C0000-memory.dmp

Filesize
7.7MB

Download
memory/4560-132-0x0000000005A00000-0x0000000005FA4000-memory.dmp

Filesize
5.6MB

Download
memory/4560-133-0x0000000005500000-0x0000000005592000-memory.dmp

Filesize
584KB

Download
memory/4560-134-0x00000000055C0000-0x00000000055CA000-memory.dmp

Filesize
40KB

Download
memory/4560-135-0x0000000005450000-0x00000000059F4000-memory.dmp

Filesize
5.6MB

Download
memory/4560-136-0x0000000006AB0000-0x0000000006B4C000-memory.dmp

Filesize
624KB

Download