xloader | f469b5c967ff28b96444a48b6769ccde102417de9d59df1878bfe486ade890dd

General

Target

931453d79c93683fde7164517bd256f8.exe
Size

606KB
MD5

931453d79c93683fde7164517bd256f8
SHA1

aad71309d2e5ae52e9a80d108ff888f11735454b
SHA256

f469b5c967ff28b96444a48b6769ccde102417de9d59df1878bfe486ade890dd
SHA512

953b2b0bd9cf3fc210a6591b75420ce64d58d4220f60fa7d31e436240fdc71768ffabd4f39b58f1e8230b3f29c24c8bfe0809c32f7b5b50aa95f7420706c1f3f

Score

10^/10

xloader ahc8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1836-61-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1836-62-0x000000000041D4F0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

931453d79c93683fde7164517bd256f8.exe

description pid process target process

PID 1220 set thread context of 1836 1220 931453d79c93683fde7164517bd256f8.exe 931453d79c93683fde7164517bd256f8.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1284 1836 WerFault.exe 931453d79c93683fde7164517bd256f8.exe

description	pid	process	target process
PID 1220 set thread context of 1836	1220	931453d79c93683fde7164517bd256f8.exe	931453d79c93683fde7164517bd256f8.exe

pid	pid_target	process	target process
1284	1836	WerFault.exe	931453d79c93683fde7164517bd256f8.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

931453d79c93683fde7164517bd256f8.exe931453d79c93683fde7164517bd256f8.exe

description	pid	process	target process
PID 1220 wrote to memory of 1836	1220	931453d79c93683fde7164517bd256f8.exe	931453d79c93683fde7164517bd256f8.exe
PID 1220 wrote to memory of 1836	1220	931453d79c93683fde7164517bd256f8.exe	931453d79c93683fde7164517bd256f8.exe
PID 1220 wrote to memory of 1836	1220	931453d79c93683fde7164517bd256f8.exe	931453d79c93683fde7164517bd256f8.exe
PID 1220 wrote to memory of 1836	1220	931453d79c93683fde7164517bd256f8.exe	931453d79c93683fde7164517bd256f8.exe
PID 1220 wrote to memory of 1836	1220	931453d79c93683fde7164517bd256f8.exe	931453d79c93683fde7164517bd256f8.exe
PID 1220 wrote to memory of 1836	1220	931453d79c93683fde7164517bd256f8.exe	931453d79c93683fde7164517bd256f8.exe
PID 1220 wrote to memory of 1836	1220	931453d79c93683fde7164517bd256f8.exe	931453d79c93683fde7164517bd256f8.exe
PID 1836 wrote to memory of 1284	1836	931453d79c93683fde7164517bd256f8.exe	WerFault.exe
PID 1836 wrote to memory of 1284	1836	931453d79c93683fde7164517bd256f8.exe	WerFault.exe
PID 1836 wrote to memory of 1284	1836	931453d79c93683fde7164517bd256f8.exe	WerFault.exe
PID 1836 wrote to memory of 1284	1836	931453d79c93683fde7164517bd256f8.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\931453d79c93683fde7164517bd256f8.exe
"C:\Users\Admin\AppData\Local\Temp\931453d79c93683fde7164517bd256f8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1220

C:\Users\Admin\AppData\Local\Temp\931453d79c93683fde7164517bd256f8.exe
"C:\Users\Admin\AppData\Local\Temp\931453d79c93683fde7164517bd256f8.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 36
3⤵
- Program crash
PID:1284

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-54-0x0000000001330000-0x00000000013CC000-memory.dmp

Filesize
624KB

Download
memory/1220-55-0x00000000005B0000-0x00000000005BC000-memory.dmp

Filesize
48KB

Download
memory/1220-56-0x0000000005F00000-0x0000000005F72000-memory.dmp

Filesize
456KB

Download
memory/1220-57-0x0000000000750000-0x0000000000780000-memory.dmp

Filesize
192KB

Download
memory/1284-63-0x0000000000000000-mapping.dmp

Download
memory/1836-58-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1836-59-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1836-61-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1836-62-0x000000000041D4F0-mapping.dmp

Download

Analysis

Sharing