xloader | 7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421

General

Target

7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
Size

966KB
MD5

c0333ad2c54dbeaa683f72272f7cdb9e
SHA1

6b83bdd574eec43323edbe989f631bbe995f4e03
SHA256

7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421
SHA512

02b6cca699f30c0f049f572150a5ebc1361ed020cd0aa9884d2e87ac90a2d362a5aed04e1a687d30a43fbf34754b14f56e999f39b60da7155f62f828e4004fe0
SSDEEP

12288:ApRCK127BZddxiQZxXapnl/DAr52S1rKgU19Mx+TYW/l0RLq2W3/T:ADCNR8DXScgU19MxbW/GEPT

Score

10^/10

xloader ur06 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ur06

Decoy

philippebrooksdesign.com

cmoorestudio.com

profille-sarina23tammara.club

dqulxe.com

uiffinger.com

nolarapper.com

maconanimalexterminator.com

bisovka.com

loveisloveent.com

datication.com

spxo66.com

drhelpnow.com

ladybug-cle.com

macocome.com

thepoppysocks.com

eldritchparadox.com

mercadolibre.company

ismartfarm.com

kansascarlot.com

kevinld.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/816-60-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/816-61-0x000000000041D000-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe

description	pid	process	target process
PID 960 set thread context of 816	960	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe

pid	process
960	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
816	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe

description pid process

Token: SeDebugPrivilege 960 7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe

description	pid	process
Token: SeDebugPrivilege	960	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe

description	pid	process	target process
PID 960 wrote to memory of 1768	960	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
PID 960 wrote to memory of 1768	960	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
PID 960 wrote to memory of 1768	960	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
PID 960 wrote to memory of 1768	960	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
PID 960 wrote to memory of 816	960	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
PID 960 wrote to memory of 816	960	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
PID 960 wrote to memory of 816	960	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
PID 960 wrote to memory of 816	960	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
PID 960 wrote to memory of 816	960	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
PID 960 wrote to memory of 816	960	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
PID 960 wrote to memory of 816	960	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe	7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe

C:\Users\Admin\AppData\Local\Temp\7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
"C:\Users\Admin\AppData\Local\Temp\7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960

C:\Users\Admin\AppData\Local\Temp\7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
"C:\Users\Admin\AppData\Local\Temp\7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe"
2⤵
PID:1768

C:\Users\Admin\AppData\Local\Temp\7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe
"C:\Users\Admin\AppData\Local\Temp\7652589d63abfff7dbd1e646b7c3d9ff0840ff5c6c9bf3fbb303189031942421.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:816

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/816-57-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/816-58-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/816-60-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/816-61-0x000000000041D000-mapping.dmp

Download
memory/816-63-0x0000000000910000-0x0000000000C13000-memory.dmp

Filesize
3.0MB

Download
memory/960-54-0x0000000074E61000-0x0000000074E63000-memory.dmp

Filesize
8KB

Download
memory/960-55-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/960-56-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download
memory/960-62-0x0000000074520000-0x0000000074ACB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads