xloader | a7492a3e2caa18c09290209462772d7356966ed9fe91f86830284d950604b300

General

Target

48d4eafd1412fe11e58cb6778be9a6cc.exe
Size

285KB
MD5

48d4eafd1412fe11e58cb6778be9a6cc
SHA1

4df1a667d1c7de90a5492146b92ffbb667d689a2
SHA256

a7492a3e2caa18c09290209462772d7356966ed9fe91f86830284d950604b300
SHA512

5a34f30f6c9d9d92938f9a357454095ee8421102de1fcce5abb827a2468f7f4050178810d0df16a7174832747453f4218a41e70388195534a93f860cc97bc2e4

Score

10^/10

xloader zgtb loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

zgtb

Decoy

gabriellep.com

honghe4.xyz

anisaofrendas.com

happy-tile.com

thesulkies.com

international-ipo.com

tazeco.info

hhhzzz.xyz

vrmonster.xyz

theearthresidencia.com

sportape.xyz

elshadaibaterias.com

koredeiihibi.com

taxtaa.com

globalcityb.com

fxivcama.com

dagsmith.com

elmar-bhp.com

peakice.net

jhcdjewelry.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3800-132-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral2/memory/3800-134-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral2/memory/380-140-0x0000000000420000-0x000000000044B000-memory.dmp	xloader
behavioral2/memory/380-145-0x0000000000420000-0x000000000044B000-memory.dmp	xloader

Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

42 380 msiexec.exe
46 380 msiexec.exe

flow	pid	process
42	380	msiexec.exe
46	380	msiexec.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

48d4eafd1412fe11e58cb6778be9a6cc.execvtres.exemsiexec.exe

description	pid	process	target process
PID 2748 set thread context of 3800	2748	48d4eafd1412fe11e58cb6778be9a6cc.exe	cvtres.exe
PID 3800 set thread context of 2952	3800	cvtres.exe	Explorer.EXE
PID 380 set thread context of 2952	380	msiexec.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 52 IoCs

Processes:

cvtres.exemsiexec.exe

pid	process
3800	cvtres.exe
3800	cvtres.exe
3800	cvtres.exe
3800	cvtres.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe
380	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2952 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

cvtres.exemsiexec.exe

pid process

3800 cvtres.exe
3800 cvtres.exe
3800 cvtres.exe
380 msiexec.exe
380 msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cvtres.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 3800 cvtres.exe
Token: SeDebugPrivilege 380 msiexec.exe

pid	process
2952	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	3800	cvtres.exe
Token: SeDebugPrivilege	380	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

48d4eafd1412fe11e58cb6778be9a6cc.exeExplorer.EXEmsiexec.exe

description	pid	process	target process
PID 2748 wrote to memory of 3800	2748	48d4eafd1412fe11e58cb6778be9a6cc.exe	cvtres.exe
PID 2748 wrote to memory of 3800	2748	48d4eafd1412fe11e58cb6778be9a6cc.exe	cvtres.exe
PID 2748 wrote to memory of 3800	2748	48d4eafd1412fe11e58cb6778be9a6cc.exe	cvtres.exe
PID 2748 wrote to memory of 3800	2748	48d4eafd1412fe11e58cb6778be9a6cc.exe	cvtres.exe
PID 2748 wrote to memory of 3800	2748	48d4eafd1412fe11e58cb6778be9a6cc.exe	cvtres.exe
PID 2748 wrote to memory of 3800	2748	48d4eafd1412fe11e58cb6778be9a6cc.exe	cvtres.exe
PID 2952 wrote to memory of 380	2952	Explorer.EXE	msiexec.exe
PID 2952 wrote to memory of 380	2952	Explorer.EXE	msiexec.exe
PID 2952 wrote to memory of 380	2952	Explorer.EXE	msiexec.exe
PID 380 wrote to memory of 3344	380	msiexec.exe	cmd.exe
PID 380 wrote to memory of 3344	380	msiexec.exe	cmd.exe
PID 380 wrote to memory of 3344	380	msiexec.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2952

C:\Users\Admin\AppData\Local\Temp\48d4eafd1412fe11e58cb6778be9a6cc.exe
"C:\Users\Admin\AppData\Local\Temp\48d4eafd1412fe11e58cb6778be9a6cc.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2748

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3800

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:380

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
3⤵
PID:3344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/380-138-0x0000000000000000-mapping.dmp

Download
memory/380-145-0x0000000000420000-0x000000000044B000-memory.dmp

Filesize
172KB

Download
memory/380-143-0x0000000002200000-0x0000000002290000-memory.dmp

Filesize
576KB

Download
memory/380-142-0x00000000023D0000-0x000000000271A000-memory.dmp

Filesize
3.3MB

Download
memory/380-139-0x00000000001E0000-0x00000000001F2000-memory.dmp

Filesize
72KB

Download
memory/380-140-0x0000000000420000-0x000000000044B000-memory.dmp

Filesize
172KB

Download
memory/2748-130-0x0000000000D30000-0x0000000000D7C000-memory.dmp

Filesize
304KB

Download
memory/2952-144-0x0000000002CA0000-0x0000000002D49000-memory.dmp

Filesize
676KB

Download
memory/2952-137-0x0000000007FD0000-0x0000000008166000-memory.dmp

Filesize
1.6MB

Download
memory/2952-146-0x0000000002CA0000-0x0000000002D49000-memory.dmp

Filesize
676KB

Download
memory/3344-141-0x0000000000000000-mapping.dmp

Download
memory/3800-136-0x0000000000FC0000-0x0000000000FD1000-memory.dmp

Filesize
68KB

Download
memory/3800-135-0x0000000001000000-0x000000000134A000-memory.dmp

Filesize
3.3MB

Download
memory/3800-134-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3800-132-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3800-131-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads