xloader | a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554

General

Target

a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe
Size

728KB
MD5

7bf97c78987dee44d858343ed72da24b
SHA1

e2a445bc4e5923b355aa977cfc73a94e08706c36
SHA256

a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554
SHA512

d86e85ea50a4e8fc766c48b509d7bcabf43167ce58f731b6273c5b8c385f15b03e4c914bde8c569f508ecd6e9a7ccf5ee21d8558ef60097d7d8581c0318ee27f

Score

10^/10

xloader r007 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

r007

Decoy

trashpandaservice.com

mobileads.network

ascolstore.com

gelsinextra.com

bonestell.net

heitoll.xyz

ceapgis.com

mon-lapin.biz

miq-eva.com

rematedesillas.com

playingonline.xyz

hausense.quest

tnyzw.com

appsdial.com

addcolor.city

hagenoblog.com

michaelwesleyj.com

she-zain.com

lorhsems.com

karmaserena.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/4276-137-0x0000000000400000-0x000000000042A000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe

description	pid	process	target process
PID 2052 set thread context of 4276	2052	a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe	a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe

pid	process
4276	a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe
4276	a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe

description	pid	process	target process
PID 2052 wrote to memory of 4276	2052	a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe	a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe
PID 2052 wrote to memory of 4276	2052	a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe	a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe
PID 2052 wrote to memory of 4276	2052	a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe	a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe
PID 2052 wrote to memory of 4276	2052	a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe	a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe
PID 2052 wrote to memory of 4276	2052	a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe	a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe
PID 2052 wrote to memory of 4276	2052	a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe	a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe

C:\Users\Admin\AppData\Local\Temp\a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe
"C:\Users\Admin\AppData\Local\Temp\a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2052

C:\Users\Admin\AppData\Local\Temp\a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe
"C:\Users\Admin\AppData\Local\Temp\a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2052-130-0x0000000000800000-0x00000000008BC000-memory.dmp

Filesize
752KB

Download
memory/2052-131-0x0000000005780000-0x0000000005D24000-memory.dmp

Filesize
5.6MB

Download
memory/2052-132-0x0000000005270000-0x0000000005302000-memory.dmp

Filesize
584KB

Download
memory/2052-133-0x0000000005420000-0x00000000054BC000-memory.dmp

Filesize
624KB

Download
memory/2052-134-0x0000000005400000-0x000000000540A000-memory.dmp

Filesize
40KB

Download
memory/2052-135-0x0000000009110000-0x0000000009176000-memory.dmp

Filesize
408KB

Download
memory/4276-136-0x0000000000000000-mapping.dmp

Download
memory/4276-137-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4276-138-0x00000000016E0000-0x0000000001A2A000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads