xloader | 7a7e0f16c71d3934e048397686fcb78781c77db16bf0b2f8852a38898d2aecee

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2022 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
Size

556KB
MD5

a505757fb36d0c2945985135b1de90cb
SHA1

0f90b28aa225725493ef72a9915bf0c5082ff992
SHA256

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601
SHA512

37d993fcb3774673a840d4e13e768c7160120c04746972f8efed6c4687e9872fcc175849193510190fbc5047ce89abcce5c3457955b85e7912c09c12b1f0f011

Score

10^/10

xloader r007 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

r007

Decoy

trashpandaservice.com

mobileads.network

ascolstore.com

gelsinextra.com

bonestell.net

heitoll.xyz

ceapgis.com

mon-lapin.biz

miq-eva.com

rematedesillas.com

playingonline.xyz

hausense.quest

tnyzw.com

appsdial.com

addcolor.city

hagenoblog.com

michaelwesleyj.com

she-zain.com

lorhsems.com

karmaserena.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral3/memory/5080-138-0x0000000000400000-0x000000000042A000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

description	pid	process	target process
PID 2216 set thread context of 5080	2216	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

pid	process
2216	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
2216	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
5080	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
5080	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

description pid process

Token: SeDebugPrivilege 2216 13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

description	pid	process
Token: SeDebugPrivilege	2216	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

description	pid	process	target process
PID 2216 wrote to memory of 800	2216	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2216 wrote to memory of 800	2216	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2216 wrote to memory of 800	2216	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2216 wrote to memory of 5080	2216	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2216 wrote to memory of 5080	2216	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2216 wrote to memory of 5080	2216	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2216 wrote to memory of 5080	2216	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2216 wrote to memory of 5080	2216	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
PID 2216 wrote to memory of 5080	2216	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe	13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe

C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
"C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216

C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
"C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe"
2⤵
PID:800

C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe
"C:\Users\Admin\AppData\Local\Temp\13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-136-0x0000000000000000-mapping.dmp

Download
memory/2216-130-0x0000000000EB0000-0x0000000000F40000-memory.dmp

Filesize
576KB

Download
memory/2216-131-0x0000000005FF0000-0x0000000006594000-memory.dmp

Filesize
5.6MB

Download
memory/2216-132-0x0000000005910000-0x00000000059A2000-memory.dmp

Filesize
584KB

Download
memory/2216-133-0x0000000005A40000-0x0000000005ADC000-memory.dmp

Filesize
624KB

Download
memory/2216-134-0x00000000058E0000-0x00000000058EA000-memory.dmp

Filesize
40KB

Download
memory/2216-135-0x0000000008090000-0x00000000080F6000-memory.dmp

Filesize
408KB

Download
memory/5080-137-0x0000000000000000-mapping.dmp

Download
memory/5080-138-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/5080-139-0x0000000001760000-0x0000000001AAA000-memory.dmp

Filesize
3.3MB

Download