xloader | 8ecc7ecdce9763d43b61041cbc6c2151fc8583a01af584f7f5fe0999d127aaf6

General

Target

tmp.exe
Size

659KB
MD5

680597e569b66c1c77f1f3ef9d145080
SHA1

c21684c64fe6ff4ea94691a035b47cfec7dcfb05
SHA256

8ecc7ecdce9763d43b61041cbc6c2151fc8583a01af584f7f5fe0999d127aaf6
SHA512

c9d2613706df5b2ed82f5650a1812565441e1d09f733cfbf11f14e6e53d92d12a7a827b272de6605c0230165c7526aea925ef53cdd148fbf6fa8bee86714c540

Score

10^/10

xloader ocgr loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ocgr

Decoy

shiftmedicalstaffing.agency

muktobangla.xyz

attmleather.com

modelahs.com

clime.email

yonatec.com

mftie.com

doxofcolor.com

american-atlantic.net

christineenergy.com

fjqsdz.com

nagpurmandarin.com

hofwimmer.com

gororidev.com

china-eros.com

xn--ekrt15fxyb2t2c.xn--czru2d

dabsavy.com

buggy4t.com

souplant.com

insurancewineappraisals.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/844-61-0x000000000041D480-mapping.dmp	xloader
behavioral1/memory/844-60-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/844-63-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1060-69-0x00000000000D0000-0x00000000000F9000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1796 set thread context of 844	1796	tmp.exe	28
PID 844 set thread context of 1204	844	aspnet_compiler.exe	9
PID 1060 set thread context of 1204	1060	help.exe	9

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
844	aspnet_compiler.exe
844	aspnet_compiler.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe
1060	help.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
844	aspnet_compiler.exe
844	aspnet_compiler.exe
844	aspnet_compiler.exe
1060	help.exe
1060	help.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1796	tmp.exe
Token: SeDebugPrivilege	844	aspnet_compiler.exe
Token: SeDebugPrivilege	1060	help.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 844	1796	tmp.exe	28
PID 1796 wrote to memory of 844	1796	tmp.exe	28
PID 1796 wrote to memory of 844	1796	tmp.exe	28
PID 1796 wrote to memory of 844	1796	tmp.exe	28
PID 1796 wrote to memory of 844	1796	tmp.exe	28
PID 1796 wrote to memory of 844	1796	tmp.exe	28
PID 1796 wrote to memory of 844	1796	tmp.exe	28
PID 1204 wrote to memory of 1060	1204	Explorer.EXE	29
PID 1204 wrote to memory of 1060	1204	Explorer.EXE	29
PID 1204 wrote to memory of 1060	1204	Explorer.EXE	29
PID 1204 wrote to memory of 1060	1204	Explorer.EXE	29
PID 1060 wrote to memory of 1196	1060	help.exe	30
PID 1060 wrote to memory of 1196	1060	help.exe	30
PID 1060 wrote to memory of 1196	1060	help.exe	30
PID 1060 wrote to memory of 1196	1060	help.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:844
- C:\Windows\SysWOW64\help.exe
  "C:\Windows\SysWOW64\help.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-65-0x0000000000200000-0x0000000000211000-memory.dmp

Filesize
68KB

Download
memory/844-63-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/844-64-0x00000000008C0000-0x0000000000BC3000-memory.dmp

Filesize
3.0MB

Download
memory/844-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/844-58-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/844-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1060-74-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1060-68-0x00000000007E0000-0x00000000007E6000-memory.dmp

Filesize
24KB

Download
memory/1060-69-0x00000000000D0000-0x00000000000F9000-memory.dmp

Filesize
164KB

Download
memory/1060-71-0x00000000007F0000-0x0000000000AF3000-memory.dmp

Filesize
3.0MB

Download
memory/1060-72-0x00000000005D0000-0x0000000000660000-memory.dmp

Filesize
576KB

Download
memory/1204-66-0x0000000004B00000-0x0000000004BDC000-memory.dmp

Filesize
880KB

Download
memory/1204-73-0x00000000068D0000-0x0000000006A21000-memory.dmp

Filesize
1.3MB

Download
memory/1796-56-0x00000000004C0000-0x00000000004C8000-memory.dmp

Filesize
32KB

Download
memory/1796-55-0x0000000000460000-0x0000000000470000-memory.dmp

Filesize
64KB

Download
memory/1796-54-0x0000000000C40000-0x0000000000CE8000-memory.dmp

Filesize
672KB

Download

Analysis

Sharing