xloader | 23a38a6f4f071442244e32033a1672cbe57ef0296bac9a3514cde315e417f632

General

Target

shipping docs.exe
Size

596KB
MD5

ee97e8134d2d81d1b0496cdc9a47e20a
SHA1

b55593f9448acf6cd5dde7e5635194ff042c289f
SHA256

23a38a6f4f071442244e32033a1672cbe57ef0296bac9a3514cde315e417f632
SHA512

cc52daed4f05abe7d9cd8900e23b97b57070abb8e15e34c4b6897350966e97905349c97edfca5bebdbbb4c9fb7331721dc3947d15e33c15ae8f482cd01f4259b

Score

10^/10

xloader a8hq loader rat

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

a8hq

Decoy

veteransductcleaning.com

beajtjunkies.com

houseofascofi.com

scottsdalemediator.com

atelyadesign.com

profitcase.pro

imtokenio.club

qinglingpai.com

bigsmile-meal.net

daytonlivestream.com

aspiradores10.online

ytybs120.com

hdatelier.com

bearpierce.com

yeson28ca.com

booklearner.com

m8j9.club

mmophamthinhlegend.space

hq4a7o6zb.com

sophiadaki.online

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1400-62-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral1/memory/1400-63-0x000000000041F2C0-mapping.dmp	xloader
behavioral1/memory/1400-68-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral1/memory/1400-71-0x0000000000400000-0x000000000042B000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

Processes:

shipping docs.exeshipping docs.exe

description	pid	process	target process
PID 1384 set thread context of 1400	1384	shipping docs.exe	shipping docs.exe
PID 1400 set thread context of 1232	1400	shipping docs.exe	Explorer.EXE
PID 1400 set thread context of 1232	1400	shipping docs.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

shipping docs.exeshipping docs.exe

pid process

1384 shipping docs.exe
1384 shipping docs.exe
1400 shipping docs.exe
1400 shipping docs.exe
1400 shipping docs.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

shipping docs.exe

pid process

1400 shipping docs.exe
1400 shipping docs.exe

pid	process
1384	shipping docs.exe
1384	shipping docs.exe
1400	shipping docs.exe
1400	shipping docs.exe
1400	shipping docs.exe

pid	process
1400	shipping docs.exe
1400	shipping docs.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

shipping docs.exeshipping docs.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1384	shipping docs.exe
Token: SeDebugPrivilege	1400	shipping docs.exe
Token: SeShutdownPrivilege	1232	Explorer.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

shipping docs.exe

description	pid	process	target process
PID 1384 wrote to memory of 1400	1384	shipping docs.exe	shipping docs.exe
PID 1384 wrote to memory of 1400	1384	shipping docs.exe	shipping docs.exe
PID 1384 wrote to memory of 1400	1384	shipping docs.exe	shipping docs.exe
PID 1384 wrote to memory of 1400	1384	shipping docs.exe	shipping docs.exe
PID 1384 wrote to memory of 1400	1384	shipping docs.exe	shipping docs.exe
PID 1384 wrote to memory of 1400	1384	shipping docs.exe	shipping docs.exe
PID 1384 wrote to memory of 1400	1384	shipping docs.exe	shipping docs.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Users\Admin\AppData\Local\Temp\shipping docs.exe
"C:\Users\Admin\AppData\Local\Temp\shipping docs.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384

C:\Users\Admin\AppData\Local\Temp\shipping docs.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1400

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-70-0x0000000007020000-0x000000000718C000-memory.dmp

Filesize
1.4MB

Download
memory/1232-67-0x0000000004B30000-0x0000000004C9F000-memory.dmp

Filesize
1.4MB

Download
memory/1384-54-0x0000000000A90000-0x0000000000B2C000-memory.dmp

Filesize
624KB

Download
memory/1384-55-0x0000000076011000-0x0000000076013000-memory.dmp

Filesize
8KB

Download
memory/1384-56-0x0000000000330000-0x000000000033A000-memory.dmp

Filesize
40KB

Download
memory/1384-57-0x0000000005220000-0x00000000052A2000-memory.dmp

Filesize
520KB

Download
memory/1384-58-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1400-63-0x000000000041F2C0-mapping.dmp

Download
memory/1400-62-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1400-65-0x0000000000B30000-0x0000000000E33000-memory.dmp

Filesize
3.0MB

Download
memory/1400-60-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1400-66-0x00000000001F0000-0x0000000000201000-memory.dmp

Filesize
68KB

Download
memory/1400-68-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1400-69-0x0000000000380000-0x0000000000391000-memory.dmp

Filesize
68KB

Download
memory/1400-59-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1400-71-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads