xloader | 5d429d5b5040db22296b658ddf87b4ee8a5dd7ba5e780453c2336dd13555e4bf

General

Target

shipping docs.exe
Size

608KB
MD5

b2746eceecc59cdef8881c91a88550f4
SHA1

63011e47cee50731bbd9b3cc8a15dbb6b9f8fad7
SHA256

5d429d5b5040db22296b658ddf87b4ee8a5dd7ba5e780453c2336dd13555e4bf
SHA512

8855654ba48a0fd8220adaffe97d636652fdd480aed3d12da4884f9b277ab53924dd290e71fba1fb33ff6635e2656d50660479ab4491adb4dbafc482655da922

Score

10^/10

xloader a8hq loader rat

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

a8hq

Decoy

veteransductcleaning.com

beajtjunkies.com

houseofascofi.com

scottsdalemediator.com

atelyadesign.com

profitcase.pro

imtokenio.club

qinglingpai.com

bigsmile-meal.net

daytonlivestream.com

aspiradores10.online

ytybs120.com

hdatelier.com

bearpierce.com

yeson28ca.com

booklearner.com

m8j9.club

mmophamthinhlegend.space

hq4a7o6zb.com

sophiadaki.online

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4852-136-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral2/memory/4852-141-0x0000000000400000-0x000000000042B000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

Processes:

shipping docs.exeshipping docs.exe

description	pid	process	target process
PID 5056 set thread context of 4852	5056	shipping docs.exe	shipping docs.exe
PID 4852 set thread context of 796	4852	shipping docs.exe	Explorer.EXE
PID 4852 set thread context of 796	4852	shipping docs.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

shipping docs.exe

pid process

4852 shipping docs.exe
4852 shipping docs.exe
4852 shipping docs.exe
4852 shipping docs.exe
4852 shipping docs.exe
4852 shipping docs.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

796 Explorer.EXE
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

shipping docs.exe

pid process

4852 shipping docs.exe
4852 shipping docs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

shipping docs.exe

description pid process

Token: SeDebugPrivilege 4852 shipping docs.exe

pid	process
4852	shipping docs.exe
4852	shipping docs.exe
4852	shipping docs.exe
4852	shipping docs.exe
4852	shipping docs.exe
4852	shipping docs.exe

pid	process
796	Explorer.EXE

pid	process
4852	shipping docs.exe
4852	shipping docs.exe

description	pid	process
Token: SeDebugPrivilege	4852	shipping docs.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

shipping docs.exe

description	pid	process	target process
PID 5056 wrote to memory of 4852	5056	shipping docs.exe	shipping docs.exe
PID 5056 wrote to memory of 4852	5056	shipping docs.exe	shipping docs.exe
PID 5056 wrote to memory of 4852	5056	shipping docs.exe	shipping docs.exe
PID 5056 wrote to memory of 4852	5056	shipping docs.exe	shipping docs.exe
PID 5056 wrote to memory of 4852	5056	shipping docs.exe	shipping docs.exe
PID 5056 wrote to memory of 4852	5056	shipping docs.exe	shipping docs.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:796

C:\Users\Admin\AppData\Local\Temp\shipping docs.exe
"C:\Users\Admin\AppData\Local\Temp\shipping docs.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5056

C:\Users\Admin\AppData\Local\Temp\shipping docs.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/796-140-0x0000000002CB0000-0x0000000002DAE000-memory.dmp

Filesize
1016KB

Download
memory/796-143-0x0000000002DB0000-0x0000000002F2A000-memory.dmp

Filesize
1.5MB

Download
memory/4852-136-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4852-135-0x0000000000000000-mapping.dmp

Download
memory/4852-138-0x0000000001020000-0x000000000136A000-memory.dmp

Filesize
3.3MB

Download
memory/4852-139-0x0000000000F80000-0x0000000000F91000-memory.dmp

Filesize
68KB

Download
memory/4852-141-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4852-142-0x0000000000FE0000-0x0000000000FF1000-memory.dmp

Filesize
68KB

Download
memory/5056-133-0x00000000054A0000-0x000000000553C000-memory.dmp

Filesize
624KB

Download
memory/5056-134-0x0000000005590000-0x000000000559A000-memory.dmp

Filesize
40KB

Download
memory/5056-130-0x0000000000940000-0x00000000009DE000-memory.dmp

Filesize
632KB

Download
memory/5056-132-0x0000000005400000-0x0000000005492000-memory.dmp

Filesize
584KB

Download
memory/5056-131-0x00000000059B0000-0x0000000005F54000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads