xloader | 0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e

General

Target

0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe
Size

635KB
MD5

e32e254b685cd1709f4ef86b5441d84e
SHA1

55d4645e42f4104229ced1fff95532ee7bd6632a
SHA256

0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e
SHA512

4e01d48e6827da547c27b3f6063ec87537d98532b7a2c81e37a8531abe664a3c5bef2629292be1c12c7da8a1a0a100f64b007869c34e3951026fa2f9af25419d

Score

10^/10

xloader nn40 loader rat

Malware Config

Extracted

Family

xloader

Version

2.8

Campaign

nn40

Decoy

LYAg0yANOGEAGeaFOrA/

MQWuERZplP+VZy/uszI=

CF0oDN0JimIaGy/uszI=

ltJnyC+ReohYaiTvj1qbEA==

B9OkgdctVKBAFjSUaw==

sbDVwSZVVqVB11/deow8GA==

v1gHDe0pzno=

i+/0n2vHUfGPR98k77tukZ90MQ==

SUtCnbS96Qm21g==

8X9qzyt1dpAo31jXrXfKb49fBPY=

5KlPxqHzSstuFjSUaw==

0r/Kesv/zuanroxvNQW0Gm8=

FFgS7kfPYAqpdhhgRgnBJHY=

LgusAHrkrIoWr0FWIe2o/04UXPw=

vBq9Gvxa9wbKbS/uszI=

Z+q6HAZNNeqwwQ==

wbS4fMb06SjU5Kbseow8GA==

1mZEuZvJ/m0L9bof56PkkZ90MQ==

JCJIM74lHk/o+tiFOrA/

d14FrM8rGEgIzVkT67+3XaEh

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3836-136-0x0000000000400000-0x000000000042C000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe

description	pid	process	target process
PID 3840 set thread context of 3836	3840	0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe	0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe

pid	process
3836	0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe
3836	0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe

description	pid	process	target process
PID 3840 wrote to memory of 3836	3840	0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe	0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe
PID 3840 wrote to memory of 3836	3840	0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe	0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe
PID 3840 wrote to memory of 3836	3840	0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe	0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe
PID 3840 wrote to memory of 3836	3840	0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe	0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe
PID 3840 wrote to memory of 3836	3840	0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe	0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe
PID 3840 wrote to memory of 3836	3840	0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe	0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe

C:\Users\Admin\AppData\Local\Temp\0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe
"C:\Users\Admin\AppData\Local\Temp\0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3840

C:\Users\Admin\AppData\Local\Temp\0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe
"C:\Users\Admin\AppData\Local\Temp\0cfac9ebd9e0bb5a2f128f38b9879e4f103208c8559a68a18bb099fa2b8bf18e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3836-135-0x0000000000000000-mapping.dmp

Download
memory/3836-136-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3836-137-0x00000000013B0000-0x00000000016FA000-memory.dmp

Filesize
3.3MB

Download
memory/3840-130-0x0000000000CF0000-0x0000000000D96000-memory.dmp

Filesize
664KB

Download
memory/3840-131-0x0000000007FE0000-0x0000000008584000-memory.dmp

Filesize
5.6MB

Download
memory/3840-132-0x0000000007AD0000-0x0000000007B62000-memory.dmp

Filesize
584KB

Download
memory/3840-133-0x0000000007AC0000-0x0000000007ACA000-memory.dmp

Filesize
40KB

Download
memory/3840-134-0x0000000009D10000-0x0000000009DAC000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads