xloader | 3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9

General

Target

3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe
Size

21KB
MD5

dce19521a9244e07348ad6d9594d0e82
SHA1

0afa324ff68a5e398c1c7d2b1c86ad2c8cc1c9aa
SHA256

3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9
SHA512

49892e61920f4baf2d3228ab5b985c4252411cb40bca68d3fa069148cf474c1a3160f043c3b2b532634e361350be9f39bd89a9e92361c962dc65cab5b939a496

Score

10^/10

xloader ahc8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2552-119-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2552-120-0x000000000041D4F0-mapping.dmp	xloader

Downloads MZ/PE file

Suspicious use of SetThreadContext 1 IoCs

Processes:

3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe

description	pid	process	target process
PID 2484 set thread context of 2552	2484	3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe	3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe

pid	process
2552	3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe
2552	3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe

description pid process

Token: SeDebugPrivilege 2484 3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe

description	pid	process
Token: SeDebugPrivilege	2484	3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe

description	pid	process	target process
PID 2484 wrote to memory of 2552	2484	3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe	3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe
PID 2484 wrote to memory of 2552	2484	3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe	3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe
PID 2484 wrote to memory of 2552	2484	3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe	3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe
PID 2484 wrote to memory of 2552	2484	3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe	3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe
PID 2484 wrote to memory of 2552	2484	3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe	3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe
PID 2484 wrote to memory of 2552	2484	3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe	3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe

C:\Users\Admin\AppData\Local\Temp\3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe
"C:\Users\Admin\AppData\Local\Temp\3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484

C:\Users\Admin\AppData\Local\Temp\3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe
"C:\Users\Admin\AppData\Local\Temp\3b14b04160d49bdd074d3d571992ed5333b8292a3c0f8f58988c606bd91408f9.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2484-114-0x0000000000490000-0x000000000049C000-memory.dmp

Filesize
48KB

Download
memory/2484-115-0x0000000005250000-0x000000000574E000-memory.dmp

Filesize
5.0MB

Download
memory/2484-116-0x0000000004D50000-0x0000000004DE2000-memory.dmp

Filesize
584KB

Download
memory/2484-117-0x0000000005D50000-0x0000000005D8E000-memory.dmp

Filesize
248KB

Download
memory/2484-118-0x0000000005E30000-0x0000000005ECC000-memory.dmp

Filesize
624KB

Download
memory/2552-119-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2552-120-0x000000000041D4F0-mapping.dmp

Download
memory/2552-121-0x0000000000E20000-0x0000000001140000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads