xloader | 8ecc7ecdce9763d43b61041cbc6c2151fc8583a01af584f7f5fe0999d127aaf6

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
28-04-2022 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

659KB
MD5

680597e569b66c1c77f1f3ef9d145080
SHA1

c21684c64fe6ff4ea94691a035b47cfec7dcfb05
SHA256

8ecc7ecdce9763d43b61041cbc6c2151fc8583a01af584f7f5fe0999d127aaf6
SHA512

c9d2613706df5b2ed82f5650a1812565441e1d09f733cfbf11f14e6e53d92d12a7a827b272de6605c0230165c7526aea925ef53cdd148fbf6fa8bee86714c540

Score

10^/10

xloader ocgr loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ocgr

Decoy

shiftmedicalstaffing.agency

muktobangla.xyz

attmleather.com

modelahs.com

clime.email

yonatec.com

mftie.com

doxofcolor.com

american-atlantic.net

christineenergy.com

fjqsdz.com

nagpurmandarin.com

hofwimmer.com

gororidev.com

china-eros.com

xn--ekrt15fxyb2t2c.xn--czru2d

dabsavy.com

buggy4t.com

souplant.com

insurancewineappraisals.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2316-133-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/2316-135-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/4672-142-0x00000000007A0000-0x00000000007C9000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1240 set thread context of 2316	1240	tmp.exe	82
PID 2316 set thread context of 2084	2316	aspnet_compiler.exe	37
PID 4672 set thread context of 2084	4672	mstsc.exe	37

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
2316	aspnet_compiler.exe
2316	aspnet_compiler.exe
2316	aspnet_compiler.exe
2316	aspnet_compiler.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe
4672	mstsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2084	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2316	aspnet_compiler.exe
2316	aspnet_compiler.exe
2316	aspnet_compiler.exe
4672	mstsc.exe
4672	mstsc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1240	tmp.exe
Token: SeDebugPrivilege	2316	aspnet_compiler.exe
Token: SeDebugPrivilege	4672	mstsc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 2316	1240	tmp.exe	82
PID 1240 wrote to memory of 2316	1240	tmp.exe	82
PID 1240 wrote to memory of 2316	1240	tmp.exe	82
PID 1240 wrote to memory of 2316	1240	tmp.exe	82
PID 1240 wrote to memory of 2316	1240	tmp.exe	82
PID 1240 wrote to memory of 2316	1240	tmp.exe	82
PID 2084 wrote to memory of 4672	2084	Explorer.EXE	83
PID 2084 wrote to memory of 4672	2084	Explorer.EXE	83
PID 2084 wrote to memory of 4672	2084	Explorer.EXE	83
PID 4672 wrote to memory of 3764	4672	mstsc.exe	87
PID 4672 wrote to memory of 3764	4672	mstsc.exe	87
PID 4672 wrote to memory of 3764	4672	mstsc.exe	87

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2316
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\SysWOW64\mstsc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1240-130-0x00000000006A0000-0x0000000000748000-memory.dmp

Filesize
672KB

Download
memory/1240-131-0x0000000005160000-0x00000000051FC000-memory.dmp

Filesize
624KB

Download
memory/2084-145-0x0000000008570000-0x000000000862B000-memory.dmp

Filesize
748KB

Download
memory/2084-138-0x0000000008780000-0x0000000008926000-memory.dmp

Filesize
1.6MB

Download
memory/2316-137-0x0000000001B30000-0x0000000001B41000-memory.dmp

Filesize
68KB

Download
memory/2316-136-0x00000000017E0000-0x0000000001B2A000-memory.dmp

Filesize
3.3MB

Download
memory/2316-135-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2316-133-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4672-141-0x0000000000900000-0x0000000000A3A000-memory.dmp

Filesize
1.2MB

Download
memory/4672-142-0x00000000007A0000-0x00000000007C9000-memory.dmp

Filesize
164KB

Download
memory/4672-143-0x0000000002BE0000-0x0000000002F2A000-memory.dmp

Filesize
3.3MB

Download
memory/4672-144-0x0000000002900000-0x0000000002990000-memory.dmp

Filesize
576KB

Download