xloader | 4eac3744a1240baa0ba6a519876425b8c52ddaefcb6e65afe077d71b1393ae52

General

Target
SWIFT COPY.exe
Size 521KB
Sample220321-s3pjsadfdm
SHA256 4eac3744a1240baa0ba6a519876425b8c52ddaefcb6e65afe077d71b1393ae52
MD5 a1e4e121c1bf7157a4b99f5f47492c80
SHA1 a689e4386bc380ffbacef832f49d7984bb2d19c9
SHA512 56e02018651381daa382af3cd226e09960a1732c3461e4dde6d2deefe4cb001ea87396d5981d20c697c1708bc683efb019a8fc2fd1133dbe661714ee22c6989f
MD5 SHA1 SHA512

Score

10^/10

xloader sued loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

sued

Decoy

otazkystookt.quest
verskylife.rest
jhnana.com
latelequesuma.com
amanuensedigitale.com
nsrtx.com
sandospizzeria.com
easychu.com
yewryueui.store
grupoabintegra.com
daylliance.com
sddn58.xyz
datarbl.com
ristorantefontanamurata.com
sophietatarchuk.com
narcoz.club
velociget.com
279521.com
blandinelobela.com
fintekx.com
breatheblock.com
ninatrinitytv.com
elmarmeet.com
nakedgirlphoto.com
ztgame.xyz
ocvcoins.com
belgiumwithaview.com
orderingink.com
floatwinebar.com
nicolavizzoca.com
after80design.com
cdrzre.ltd
kcgtradings.com
riverhouseliving.com
topprowatersolutions.com
gasspringsmfg.com
drwirelessshop.biz
lyriq.club
fxprophet.com
franzrcs.com
iconnect-design.com
sonataproductions.com
samanthapaigegems.com
syntheticloot.net
b148tlrnd09ustnnaku2721.com
timdixonpreferredadvisors.com
livepo188.net
blue-chipwordtoscan-today.info
jointshealthy.com
timeforus442.rest
pievalleyfarm.com
eehh55.com
healthmascot.com
governmentphones.sbs
andriylysenko.com
tempuausaha.com
milestonebhsllc.com
lumilentmed.com
newlighthousegibraltar.com
jelinkovo.com
boutiqueluxury.store
ratesosdem.quest
emmygrace.com
ipelard.com
nspc-kw.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1964-64-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1888 set thread context of 1964	1888	SWIFT COPY.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1124	1964	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1888	SWIFT COPY.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	SWIFT COPY.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 468	1888	SWIFT COPY.exe	27
PID 1888 wrote to memory of 468	1888	SWIFT COPY.exe	27
PID 1888 wrote to memory of 468	1888	SWIFT COPY.exe	27
PID 1888 wrote to memory of 468	1888	SWIFT COPY.exe	27
PID 1888 wrote to memory of 1964	1888	SWIFT COPY.exe	28
PID 1888 wrote to memory of 1964	1888	SWIFT COPY.exe	28
PID 1888 wrote to memory of 1964	1888	SWIFT COPY.exe	28
PID 1888 wrote to memory of 1964	1888	SWIFT COPY.exe	28
PID 1888 wrote to memory of 1964	1888	SWIFT COPY.exe	28
PID 1888 wrote to memory of 1964	1888	SWIFT COPY.exe	28
PID 1888 wrote to memory of 1964	1888	SWIFT COPY.exe	28
PID 1964 wrote to memory of 1124	1964	SWIFT COPY.exe	29
PID 1964 wrote to memory of 1124	1964	SWIFT COPY.exe	29
PID 1964 wrote to memory of 1124	1964	SWIFT COPY.exe	29
PID 1964 wrote to memory of 1124	1964	SWIFT COPY.exe	29

C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.exe
  "{path}"
  2⤵
  PID:468
- C:\Users\Admin\AppData\Local\Temp\SWIFT COPY.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 36
    3⤵
    - Program crash
    PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1888-54-0x00000000008D0000-0x0000000000958000-memory.dmp

Download

memory/1888-55-0x0000000073F50000-0x000000007463E000-memory.dmp

Download

memory/1888-56-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Download

memory/1888-57-0x00000000002D0000-0x00000000002DA000-memory.dmp

Download

memory/1888-58-0x0000000004E30000-0x0000000004EAE000-memory.dmp

Download

memory/1888-59-0x0000000004100000-0x0000000004130000-memory.dmp

Download

memory/1964-60-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1964-62-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1964-64-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads