xloader | c9777cb78779de98104f1a01584f9df07e39b7ace7d5e6686d225e7261bd9447

General

Target

a09f93f7606aa64851c9a8f82317b72f.exe
Size

517KB
MD5

a09f93f7606aa64851c9a8f82317b72f
SHA1

c33ea2eb219a088610847905251e5e2c3d2c87a2
SHA256

c9777cb78779de98104f1a01584f9df07e39b7ace7d5e6686d225e7261bd9447
SHA512

c5923ec47cc02a048fbbe8876c6f982d56dd6ea8936848db5a51ec6ad8ce16df9271a00c187a9ea653beaa490ba769c1339a5c3384180ba4d3961c471b7dfd59

Score

10^/10

xloader nn40 loader rat

Malware Config

Extracted

Family

xloader

Version

2.8

Campaign

nn40

Decoy

LYAg0yANOGEAGeaFOrA/

MQWuERZplP+VZy/uszI=

CF0oDN0JimIaGy/uszI=

ltJnyC+ReohYaiTvj1qbEA==

B9OkgdctVKBAFjSUaw==

sbDVwSZVVqVB11/deow8GA==

v1gHDe0pzno=

i+/0n2vHUfGPR98k77tukZ90MQ==

SUtCnbS96Qm21g==

8X9qzyt1dpAo31jXrXfKb49fBPY=

5KlPxqHzSstuFjSUaw==

0r/Kesv/zuanroxvNQW0Gm8=

FFgS7kfPYAqpdhhgRgnBJHY=

LgusAHrkrIoWr0FWIe2o/04UXPw=

vBq9Gvxa9wbKbS/uszI=

Z+q6HAZNNeqwwQ==

wbS4fMb06SjU5Kbseow8GA==

1mZEuZvJ/m0L9bof56PkkZ90MQ==

JCJIM74lHk/o+tiFOrA/

d14FrM8rGEgIzVkT67+3XaEh

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2020-62-0x0000000000400000-0x000000000042C000-memory.dmp	xloader
behavioral1/memory/2020-63-0x000000000041F640-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

a09f93f7606aa64851c9a8f82317b72f.exe

description pid process target process

PID 972 set thread context of 2020 972 a09f93f7606aa64851c9a8f82317b72f.exe a09f93f7606aa64851c9a8f82317b72f.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

a09f93f7606aa64851c9a8f82317b72f.exe

pid process

2020 a09f93f7606aa64851c9a8f82317b72f.exe

description	pid	process	target process
PID 972 set thread context of 2020	972	a09f93f7606aa64851c9a8f82317b72f.exe	a09f93f7606aa64851c9a8f82317b72f.exe

pid	process
2020	a09f93f7606aa64851c9a8f82317b72f.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

a09f93f7606aa64851c9a8f82317b72f.exe

description	pid	process	target process
PID 972 wrote to memory of 2020	972	a09f93f7606aa64851c9a8f82317b72f.exe	a09f93f7606aa64851c9a8f82317b72f.exe
PID 972 wrote to memory of 2020	972	a09f93f7606aa64851c9a8f82317b72f.exe	a09f93f7606aa64851c9a8f82317b72f.exe
PID 972 wrote to memory of 2020	972	a09f93f7606aa64851c9a8f82317b72f.exe	a09f93f7606aa64851c9a8f82317b72f.exe
PID 972 wrote to memory of 2020	972	a09f93f7606aa64851c9a8f82317b72f.exe	a09f93f7606aa64851c9a8f82317b72f.exe
PID 972 wrote to memory of 2020	972	a09f93f7606aa64851c9a8f82317b72f.exe	a09f93f7606aa64851c9a8f82317b72f.exe
PID 972 wrote to memory of 2020	972	a09f93f7606aa64851c9a8f82317b72f.exe	a09f93f7606aa64851c9a8f82317b72f.exe
PID 972 wrote to memory of 2020	972	a09f93f7606aa64851c9a8f82317b72f.exe	a09f93f7606aa64851c9a8f82317b72f.exe

C:\Users\Admin\AppData\Local\Temp\a09f93f7606aa64851c9a8f82317b72f.exe
"C:\Users\Admin\AppData\Local\Temp\a09f93f7606aa64851c9a8f82317b72f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:972

C:\Users\Admin\AppData\Local\Temp\a09f93f7606aa64851c9a8f82317b72f.exe
"C:\Users\Admin\AppData\Local\Temp\a09f93f7606aa64851c9a8f82317b72f.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2020

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-54-0x0000000000DB0000-0x0000000000E38000-memory.dmp

Filesize
544KB

Download
memory/972-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/972-56-0x0000000000250000-0x000000000025E000-memory.dmp

Filesize
56KB

Download
memory/972-57-0x0000000007320000-0x000000000738A000-memory.dmp

Filesize
424KB

Download
memory/972-58-0x00000000005A0000-0x00000000005D2000-memory.dmp

Filesize
200KB

Download
memory/2020-59-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2020-60-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2020-62-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2020-63-0x000000000041F640-mapping.dmp

Download
memory/2020-64-0x0000000000770000-0x0000000000A73000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing