xloader | d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5

General

Target

d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe
Size

616KB
MD5

c6d0aca39ecb129499f77720fbaa92b1
SHA1

e5ea01305c8447e01d78733d7982b79ac45b6581
SHA256

d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5
SHA512

3416a1b0696a7d0ee59d4289f9a243c93fb1887753b2a06c9b3e038d46739ba62365940f155aec94538aa8a8ef534126b3ded4ae8ca8e3603fcfac0b8ba2e5fd

Score

10^/10

xloader nn40 loader rat

Malware Config

Extracted

Family

xloader

Version

2.8

Campaign

nn40

Decoy

LYAg0yANOGEAGeaFOrA/

MQWuERZplP+VZy/uszI=

CF0oDN0JimIaGy/uszI=

ltJnyC+ReohYaiTvj1qbEA==

B9OkgdctVKBAFjSUaw==

sbDVwSZVVqVB11/deow8GA==

v1gHDe0pzno=

i+/0n2vHUfGPR98k77tukZ90MQ==

SUtCnbS96Qm21g==

8X9qzyt1dpAo31jXrXfKb49fBPY=

5KlPxqHzSstuFjSUaw==

0r/Kesv/zuanroxvNQW0Gm8=

FFgS7kfPYAqpdhhgRgnBJHY=

LgusAHrkrIoWr0FWIe2o/04UXPw=

vBq9Gvxa9wbKbS/uszI=

Z+q6HAZNNeqwwQ==

wbS4fMb06SjU5Kbseow8GA==

1mZEuZvJ/m0L9bof56PkkZ90MQ==

JCJIM74lHk/o+tiFOrA/

d14FrM8rGEgIzVkT67+3XaEh

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/4584-138-0x0000000000400000-0x000000000042C000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe

description	pid	process	target process
PID 3784 set thread context of 4584	3784	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exed9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe

pid	process
3784	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe
3784	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe
4584	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe
4584	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe

description pid process

Token: SeDebugPrivilege 3784 d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe

description	pid	process
Token: SeDebugPrivilege	3784	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe

description	pid	process	target process
PID 3784 wrote to memory of 4932	3784	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe
PID 3784 wrote to memory of 4932	3784	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe
PID 3784 wrote to memory of 4932	3784	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe
PID 3784 wrote to memory of 4584	3784	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe
PID 3784 wrote to memory of 4584	3784	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe
PID 3784 wrote to memory of 4584	3784	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe
PID 3784 wrote to memory of 4584	3784	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe
PID 3784 wrote to memory of 4584	3784	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe
PID 3784 wrote to memory of 4584	3784	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe	d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe

C:\Users\Admin\AppData\Local\Temp\d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe
"C:\Users\Admin\AppData\Local\Temp\d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3784

C:\Users\Admin\AppData\Local\Temp\d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe
"C:\Users\Admin\AppData\Local\Temp\d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe"
2⤵
PID:4932

C:\Users\Admin\AppData\Local\Temp\d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe
"C:\Users\Admin\AppData\Local\Temp\d9953c25aba720427a7122609ba2ec3ed42861e9acd631dc5f2a0deb3d8508b5.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3784-130-0x0000000000CD0000-0x0000000000D70000-memory.dmp

Filesize
640KB

Download
memory/3784-131-0x0000000005D20000-0x00000000062C4000-memory.dmp

Filesize
5.6MB

Download
memory/3784-132-0x0000000005770000-0x0000000005802000-memory.dmp

Filesize
584KB

Download
memory/3784-133-0x0000000005710000-0x000000000571A000-memory.dmp

Filesize
40KB

Download
memory/3784-134-0x0000000009620000-0x00000000096BC000-memory.dmp

Filesize
624KB

Download
memory/3784-135-0x0000000009760000-0x00000000097C6000-memory.dmp

Filesize
408KB

Download
memory/4584-137-0x0000000000000000-mapping.dmp

Download
memory/4584-138-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4584-139-0x0000000001570000-0x00000000018BA000-memory.dmp

Filesize
3.3MB

Download
memory/4932-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads