xloader | 7d850c7483817ae91c6b6dde59c22141b754d04ec2e0985ffcd85b08f2e9ae58

General

Target

79f342dceff76485db960d4e9de522f2.exe
Size

243KB
MD5

79f342dceff76485db960d4e9de522f2
SHA1

e54b0ca25b62d3f377b68d3037ff4d78350a627b
SHA256

7d850c7483817ae91c6b6dde59c22141b754d04ec2e0985ffcd85b08f2e9ae58
SHA512

548ab3961741ffec55a593b26bbc383e7afbae20509f475e46ecf3470334d6c125d6fc0e6ef5fd4f85eccd2492db8320628228e5c1bc5dd89ed5822bb958c1a5
SSDEEP

6144:cFgRqbsZzgQvSwEMFusUCj2eY7UBytn4/oOshpgfMc:qsZz+lMksdG7UBa4/o3kMc

Score

10^/10

xloader zgtb loader rat

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

zgtb

Decoy

gabriellep.com

honghe4.xyz

anisaofrendas.com

happy-tile.com

thesulkies.com

international-ipo.com

tazeco.info

hhhzzz.xyz

vrmonster.xyz

theearthresidencia.com

sportape.xyz

elshadaibaterias.com

koredeiihibi.com

taxtaa.com

globalcityb.com

fxivcama.com

dagsmith.com

elmar-bhp.com

peakice.net

jhcdjewelry.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2012-61-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral1/memory/2012-62-0x000000000041F1F0-mapping.dmp	xloader
behavioral1/memory/2012-64-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral1/memory/2000-70-0x0000000000090000-0x00000000000BB000-memory.dmp	xloader
behavioral1/memory/2000-74-0x0000000000090000-0x00000000000BB000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

Processes:

79f342dceff76485db960d4e9de522f2.execvtres.exewuapp.exe

description	pid	process	target process
PID 1752 set thread context of 2012	1752	79f342dceff76485db960d4e9de522f2.exe	cvtres.exe
PID 2012 set thread context of 1216	2012	cvtres.exe	Explorer.EXE
PID 2000 set thread context of 1216	2000	wuapp.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

cvtres.exewuapp.exe

pid	process
2012	cvtres.exe
2012	cvtres.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe
2000	wuapp.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

cvtres.exewuapp.exe

pid process

2012 cvtres.exe
2012 cvtres.exe
2012 cvtres.exe
2000 wuapp.exe
2000 wuapp.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

cvtres.exewuapp.exeExplorer.EXE

description pid process

Token: SeDebugPrivilege 2012 cvtres.exe
Token: SeDebugPrivilege 2000 wuapp.exe
Token: SeShutdownPrivilege 1216 Explorer.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1216 Explorer.EXE
1216 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1216 Explorer.EXE
1216 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	2012	cvtres.exe
Token: SeDebugPrivilege	2000	wuapp.exe
Token: SeShutdownPrivilege	1216	Explorer.EXE

pid	process
1216	Explorer.EXE
1216	Explorer.EXE

pid	process
1216	Explorer.EXE
1216	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

79f342dceff76485db960d4e9de522f2.exeExplorer.EXEwuapp.exe

description	pid	process	target process
PID 1752 wrote to memory of 2012	1752	79f342dceff76485db960d4e9de522f2.exe	cvtres.exe
PID 1752 wrote to memory of 2012	1752	79f342dceff76485db960d4e9de522f2.exe	cvtres.exe
PID 1752 wrote to memory of 2012	1752	79f342dceff76485db960d4e9de522f2.exe	cvtres.exe
PID 1752 wrote to memory of 2012	1752	79f342dceff76485db960d4e9de522f2.exe	cvtres.exe
PID 1752 wrote to memory of 2012	1752	79f342dceff76485db960d4e9de522f2.exe	cvtres.exe
PID 1752 wrote to memory of 2012	1752	79f342dceff76485db960d4e9de522f2.exe	cvtres.exe
PID 1752 wrote to memory of 2012	1752	79f342dceff76485db960d4e9de522f2.exe	cvtres.exe
PID 1216 wrote to memory of 2000	1216	Explorer.EXE	wuapp.exe
PID 1216 wrote to memory of 2000	1216	Explorer.EXE	wuapp.exe
PID 1216 wrote to memory of 2000	1216	Explorer.EXE	wuapp.exe
PID 1216 wrote to memory of 2000	1216	Explorer.EXE	wuapp.exe
PID 1216 wrote to memory of 2000	1216	Explorer.EXE	wuapp.exe
PID 1216 wrote to memory of 2000	1216	Explorer.EXE	wuapp.exe
PID 1216 wrote to memory of 2000	1216	Explorer.EXE	wuapp.exe
PID 2000 wrote to memory of 1772	2000	wuapp.exe	cmd.exe
PID 2000 wrote to memory of 1772	2000	wuapp.exe	cmd.exe
PID 2000 wrote to memory of 1772	2000	wuapp.exe	cmd.exe
PID 2000 wrote to memory of 1772	2000	wuapp.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216

C:\Users\Admin\AppData\Local\Temp\79f342dceff76485db960d4e9de522f2.exe
"C:\Users\Admin\AppData\Local\Temp\79f342dceff76485db960d4e9de522f2.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1140

C:\Windows\SysWOW64\wuapp.exe
"C:\Windows\SysWOW64\wuapp.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
3⤵
PID:1772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-73-0x0000000004D20000-0x0000000004E43000-memory.dmp

Filesize
1.1MB

Download
memory/1216-67-0x0000000004D20000-0x0000000004E43000-memory.dmp

Filesize
1.1MB

Download
memory/1216-77-0x0000000004E50000-0x0000000004FB7000-memory.dmp

Filesize
1.4MB

Download
memory/1216-76-0x0000000004E50000-0x0000000004FB7000-memory.dmp

Filesize
1.4MB

Download
memory/1752-55-0x0000000000500000-0x000000000053C000-memory.dmp

Filesize
240KB

Download
memory/1752-56-0x00000000004B0000-0x00000000004BE000-memory.dmp

Filesize
56KB

Download
memory/1752-57-0x0000000001DD0000-0x0000000001DD8000-memory.dmp

Filesize
32KB

Download
memory/1752-54-0x00000000001D0000-0x0000000000210000-memory.dmp

Filesize
256KB

Download
memory/1772-72-0x0000000000000000-mapping.dmp

Download
memory/2000-75-0x0000000000840000-0x00000000008D0000-memory.dmp

Filesize
576KB

Download
memory/2000-74-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/2000-78-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/2000-68-0x0000000000000000-mapping.dmp

Download
memory/2000-69-0x0000000000BC0000-0x0000000000BCB000-memory.dmp

Filesize
44KB

Download
memory/2000-70-0x0000000000090000-0x00000000000BB000-memory.dmp

Filesize
172KB

Download
memory/2000-71-0x0000000001FD0000-0x00000000022D3000-memory.dmp

Filesize
3.0MB

Download
memory/2012-59-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2012-66-0x0000000000190000-0x00000000001A1000-memory.dmp

Filesize
68KB

Download
memory/2012-65-0x0000000000AC0000-0x0000000000DC3000-memory.dmp

Filesize
3.0MB

Download
memory/2012-64-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2012-62-0x000000000041F1F0-mapping.dmp

Download
memory/2012-61-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2012-58-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads