xloader | 1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd

General

Target

1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe
Size

641KB
MD5

85be6547409011c0804230f2f09f7ca3
SHA1

33eb9c66bb959332f963ab928fdbd655ac9e5e4e
SHA256

1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd
SHA512

5e9e790f043d47bf21cd77caa556d18b957ab2c9587ef63836f84b8f42b102a8de085a2c6c2cf5a504b5a034c74dc25f2961b8415779311323e71c15b4432b7b

Score

10^/10

xloader nn40 loader rat

Malware Config

Extracted

Family

xloader

Version

2.8

Campaign

nn40

Decoy

LYAg0yANOGEAGeaFOrA/

MQWuERZplP+VZy/uszI=

CF0oDN0JimIaGy/uszI=

ltJnyC+ReohYaiTvj1qbEA==

B9OkgdctVKBAFjSUaw==

sbDVwSZVVqVB11/deow8GA==

v1gHDe0pzno=

i+/0n2vHUfGPR98k77tukZ90MQ==

SUtCnbS96Qm21g==

8X9qzyt1dpAo31jXrXfKb49fBPY=

5KlPxqHzSstuFjSUaw==

0r/Kesv/zuanroxvNQW0Gm8=

FFgS7kfPYAqpdhhgRgnBJHY=

LgusAHrkrIoWr0FWIe2o/04UXPw=

vBq9Gvxa9wbKbS/uszI=

Z+q6HAZNNeqwwQ==

wbS4fMb06SjU5Kbseow8GA==

1mZEuZvJ/m0L9bof56PkkZ90MQ==

JCJIM74lHk/o+tiFOrA/

d14FrM8rGEgIzVkT67+3XaEh

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/4216-136-0x0000000000400000-0x000000000042C000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe

description	pid	process	target process
PID 1180 set thread context of 4216	1180	1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe	1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe

pid	process
4216	1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe
4216	1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe

description	pid	process	target process
PID 1180 wrote to memory of 4216	1180	1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe	1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe
PID 1180 wrote to memory of 4216	1180	1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe	1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe
PID 1180 wrote to memory of 4216	1180	1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe	1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe
PID 1180 wrote to memory of 4216	1180	1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe	1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe
PID 1180 wrote to memory of 4216	1180	1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe	1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe
PID 1180 wrote to memory of 4216	1180	1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe	1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe

C:\Users\Admin\AppData\Local\Temp\1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe
"C:\Users\Admin\AppData\Local\Temp\1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1180

C:\Users\Admin\AppData\Local\Temp\1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe
"C:\Users\Admin\AppData\Local\Temp\1d9fc02237d06ae3ee5ea85ae14a05ab41ee99f03ac660e3f6360ac6864bf7fd.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-130-0x0000000000950000-0x00000000009F6000-memory.dmp

Filesize
664KB

Download
memory/1180-131-0x0000000005990000-0x0000000005F34000-memory.dmp

Filesize
5.6MB

Download
memory/1180-132-0x00000000053E0000-0x0000000005472000-memory.dmp

Filesize
584KB

Download
memory/1180-133-0x00000000053A0000-0x00000000053AA000-memory.dmp

Filesize
40KB

Download
memory/1180-134-0x0000000008EC0000-0x0000000008F5C000-memory.dmp

Filesize
624KB

Download
memory/4216-135-0x0000000000000000-mapping.dmp

Download
memory/4216-136-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4216-137-0x0000000001790000-0x0000000001ADA000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads