xloader | 400cf8fe4f1f1d748f7e6696227fe25164aa51e2c731e5cc621d708d0015065b

General

Target

0fa72e0e60187e79ab720cf120edab4f.exe
Size

571KB
MD5

0fa72e0e60187e79ab720cf120edab4f
SHA1

0bc9f1238c5560286a7a0273497bee2e19b73d81
SHA256

400cf8fe4f1f1d748f7e6696227fe25164aa51e2c731e5cc621d708d0015065b
SHA512

93e9424a6d2f1c62c19397b835ddb69d48fe448e549222ba49d631467053f92625ddcb2a51c85b3bf202077c8c80e933e38b7a7fcc839c79775180ba10d73f9d

Score

10^/10

xloader nekq loader rat

Malware Config

Extracted

Family

xloader

Version

2.8

Campaign

nekq

Decoy

/c9oNOPSc9aX85OuoqU=

OJ273U/T/c7no1jC

oPn68XFXJsCG6JOuoqU=

iAUbpb8k0vTRkUTK

pPasgiv9XQi4ESRJKCjRfGdj

J5jO/Yz6+M7no1jC

XdhiI9HBZsZlyKZ1jPx+JvxZEg==

uKpYHaMJ+OCnb0yGJ5d4Fg==

9/aD58LBdIIAdGJIaaiSTSuqn1/A

Q52txESw1ro3n3NlouzWgmgm06DFAvFR

nv0k5OdLOI8bBbwMrO7Lp059Fw==

NJ3N6nHo3qKAhDZJKCjRfGdj

z0FFAyMlzFonbTkMu79n

IxOiRvLolOiHw2lEcphyDfqqn1/A

Pi0Kkdu8Vr84Fg==

hGmJW4f0Eelq7fRazg3f1qZr

+O+SUb0HHflx55l0J5d4Fg==

raG3zxXI4rgz6Ipsia0=

OZuQHihvYzPayG4Ax70=

EYKIJDSGpYffFZOuoqU=

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3200-136-0x0000000000400000-0x000000000042C000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

0fa72e0e60187e79ab720cf120edab4f.exe

description pid process target process

PID 1056 set thread context of 3200 1056 0fa72e0e60187e79ab720cf120edab4f.exe 0fa72e0e60187e79ab720cf120edab4f.exe

description	pid	process	target process
PID 1056 set thread context of 3200	1056	0fa72e0e60187e79ab720cf120edab4f.exe	0fa72e0e60187e79ab720cf120edab4f.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

0fa72e0e60187e79ab720cf120edab4f.exe0fa72e0e60187e79ab720cf120edab4f.exe

pid	process
1056	0fa72e0e60187e79ab720cf120edab4f.exe
1056	0fa72e0e60187e79ab720cf120edab4f.exe
1056	0fa72e0e60187e79ab720cf120edab4f.exe
1056	0fa72e0e60187e79ab720cf120edab4f.exe
1056	0fa72e0e60187e79ab720cf120edab4f.exe
3200	0fa72e0e60187e79ab720cf120edab4f.exe
3200	0fa72e0e60187e79ab720cf120edab4f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0fa72e0e60187e79ab720cf120edab4f.exe

description pid process

Token: SeDebugPrivilege 1056 0fa72e0e60187e79ab720cf120edab4f.exe

description	pid	process
Token: SeDebugPrivilege	1056	0fa72e0e60187e79ab720cf120edab4f.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

0fa72e0e60187e79ab720cf120edab4f.exe

description	pid	process	target process
PID 1056 wrote to memory of 2960	1056	0fa72e0e60187e79ab720cf120edab4f.exe	0fa72e0e60187e79ab720cf120edab4f.exe
PID 1056 wrote to memory of 2960	1056	0fa72e0e60187e79ab720cf120edab4f.exe	0fa72e0e60187e79ab720cf120edab4f.exe
PID 1056 wrote to memory of 2960	1056	0fa72e0e60187e79ab720cf120edab4f.exe	0fa72e0e60187e79ab720cf120edab4f.exe
PID 1056 wrote to memory of 3200	1056	0fa72e0e60187e79ab720cf120edab4f.exe	0fa72e0e60187e79ab720cf120edab4f.exe
PID 1056 wrote to memory of 3200	1056	0fa72e0e60187e79ab720cf120edab4f.exe	0fa72e0e60187e79ab720cf120edab4f.exe
PID 1056 wrote to memory of 3200	1056	0fa72e0e60187e79ab720cf120edab4f.exe	0fa72e0e60187e79ab720cf120edab4f.exe
PID 1056 wrote to memory of 3200	1056	0fa72e0e60187e79ab720cf120edab4f.exe	0fa72e0e60187e79ab720cf120edab4f.exe
PID 1056 wrote to memory of 3200	1056	0fa72e0e60187e79ab720cf120edab4f.exe	0fa72e0e60187e79ab720cf120edab4f.exe
PID 1056 wrote to memory of 3200	1056	0fa72e0e60187e79ab720cf120edab4f.exe	0fa72e0e60187e79ab720cf120edab4f.exe

C:\Users\Admin\AppData\Local\Temp\0fa72e0e60187e79ab720cf120edab4f.exe
"C:\Users\Admin\AppData\Local\Temp\0fa72e0e60187e79ab720cf120edab4f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056

C:\Users\Admin\AppData\Local\Temp\0fa72e0e60187e79ab720cf120edab4f.exe
"C:\Users\Admin\AppData\Local\Temp\0fa72e0e60187e79ab720cf120edab4f.exe"
2⤵
PID:2960

C:\Users\Admin\AppData\Local\Temp\0fa72e0e60187e79ab720cf120edab4f.exe
"C:\Users\Admin\AppData\Local\Temp\0fa72e0e60187e79ab720cf120edab4f.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-130-0x0000000000C50000-0x0000000000CE6000-memory.dmp

Filesize
600KB

Download
memory/1056-131-0x0000000005F90000-0x0000000006534000-memory.dmp

Filesize
5.6MB

Download
memory/1056-132-0x0000000005AD0000-0x0000000005B62000-memory.dmp

Filesize
584KB

Download
memory/1056-133-0x0000000006540000-0x00000000065DC000-memory.dmp

Filesize
624KB

Download
memory/2960-134-0x0000000000000000-mapping.dmp

Download
memory/3200-135-0x0000000000000000-mapping.dmp

Download
memory/3200-136-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3200-137-0x0000000001990000-0x0000000001CDA000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads