xloader | 8ecc7ecdce9763d43b61041cbc6c2151fc8583a01af584f7f5fe0999d127aaf6

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
28-04-2022 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ecc7ecdce9763d43b61041cbc6c2151fc8583a01af584f7f5fe0999d127aaf6.exe
Size

659KB
MD5

680597e569b66c1c77f1f3ef9d145080
SHA1

c21684c64fe6ff4ea94691a035b47cfec7dcfb05
SHA256

8ecc7ecdce9763d43b61041cbc6c2151fc8583a01af584f7f5fe0999d127aaf6
SHA512

c9d2613706df5b2ed82f5650a1812565441e1d09f733cfbf11f14e6e53d92d12a7a827b272de6605c0230165c7526aea925ef53cdd148fbf6fa8bee86714c540

Score

10^/10

xloader ocgr loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ocgr

Decoy

shiftmedicalstaffing.agency

muktobangla.xyz

attmleather.com

modelahs.com

clime.email

yonatec.com

mftie.com

doxofcolor.com

american-atlantic.net

christineenergy.com

fjqsdz.com

nagpurmandarin.com

hofwimmer.com

gororidev.com

china-eros.com

xn--ekrt15fxyb2t2c.xn--czru2d

dabsavy.com

buggy4t.com

souplant.com

insurancewineappraisals.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/3468-133-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/3468-138-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/344-143-0x00000000012E0000-0x0000000001309000-memory.dmp	xloader

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2008 set thread context of 3468	2008	8ecc7ecdce9763d43b61041cbc6c2151fc8583a01af584f7f5fe0999d127aaf6.exe	81
PID 3468 set thread context of 2420	3468	aspnet_compiler.exe	40
PID 3468 set thread context of 2420	3468	aspnet_compiler.exe	40
PID 344 set thread context of 2420	344	control.exe	40

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
3468	aspnet_compiler.exe
3468	aspnet_compiler.exe
3468	aspnet_compiler.exe
3468	aspnet_compiler.exe
3468	aspnet_compiler.exe
3468	aspnet_compiler.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe
344	control.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2420	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
3468	aspnet_compiler.exe
3468	aspnet_compiler.exe
3468	aspnet_compiler.exe
3468	aspnet_compiler.exe
344	control.exe
344	control.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	8ecc7ecdce9763d43b61041cbc6c2151fc8583a01af584f7f5fe0999d127aaf6.exe
Token: SeDebugPrivilege	3468	aspnet_compiler.exe
Token: SeDebugPrivilege	344	control.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 3468	2008	8ecc7ecdce9763d43b61041cbc6c2151fc8583a01af584f7f5fe0999d127aaf6.exe	81
PID 2008 wrote to memory of 3468	2008	8ecc7ecdce9763d43b61041cbc6c2151fc8583a01af584f7f5fe0999d127aaf6.exe	81
PID 2008 wrote to memory of 3468	2008	8ecc7ecdce9763d43b61041cbc6c2151fc8583a01af584f7f5fe0999d127aaf6.exe	81
PID 2008 wrote to memory of 3468	2008	8ecc7ecdce9763d43b61041cbc6c2151fc8583a01af584f7f5fe0999d127aaf6.exe	81
PID 2008 wrote to memory of 3468	2008	8ecc7ecdce9763d43b61041cbc6c2151fc8583a01af584f7f5fe0999d127aaf6.exe	81
PID 2008 wrote to memory of 3468	2008	8ecc7ecdce9763d43b61041cbc6c2151fc8583a01af584f7f5fe0999d127aaf6.exe	81
PID 2420 wrote to memory of 344	2420	Explorer.EXE	86
PID 2420 wrote to memory of 344	2420	Explorer.EXE	86
PID 2420 wrote to memory of 344	2420	Explorer.EXE	86
PID 344 wrote to memory of 1844	344	control.exe	88
PID 344 wrote to memory of 1844	344	control.exe	88
PID 344 wrote to memory of 1844	344	control.exe	88

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\8ecc7ecdce9763d43b61041cbc6c2151fc8583a01af584f7f5fe0999d127aaf6.exe
  "C:\Users\Admin\AppData\Local\Temp\8ecc7ecdce9763d43b61041cbc6c2151fc8583a01af584f7f5fe0999d127aaf6.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3468
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\SysWOW64\control.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:344
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/344-142-0x00000000005F0000-0x0000000000617000-memory.dmp

Filesize
156KB

Download
memory/344-146-0x0000000002FE0000-0x0000000003070000-memory.dmp

Filesize
576KB

Download
memory/344-144-0x0000000003280000-0x00000000035CA000-memory.dmp

Filesize
3.3MB

Download
memory/344-143-0x00000000012E0000-0x0000000001309000-memory.dmp

Filesize
164KB

Download
memory/2008-131-0x0000000005270000-0x000000000530C000-memory.dmp

Filesize
624KB

Download
memory/2008-130-0x0000000000710000-0x00000000007B8000-memory.dmp

Filesize
672KB

Download
memory/2420-147-0x0000000007F30000-0x0000000007FEA000-memory.dmp

Filesize
744KB

Download
memory/2420-137-0x0000000002500000-0x0000000002621000-memory.dmp

Filesize
1.1MB

Download
memory/2420-140-0x0000000007E70000-0x0000000007F25000-memory.dmp

Filesize
724KB

Download
memory/3468-134-0x0000000000F90000-0x00000000012DA000-memory.dmp

Filesize
3.3MB

Download
memory/3468-139-0x0000000002CB0000-0x0000000002CC1000-memory.dmp

Filesize
68KB

Download
memory/3468-138-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3468-136-0x0000000000F50000-0x0000000000F61000-memory.dmp

Filesize
68KB

Download
memory/3468-133-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download