xloader | d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a

General

Target

d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
Size

847KB
MD5

0f15fde98b90284e0e85c2ffae134257
SHA1

1946df71ecb4ccac1dbf4ca156b48ec2557e67fe
SHA256

d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a
SHA512

a1522d7c4b0f3ff9e4392916fd46c2c372cb8fea54be9d82ca9cbabaa307fc432b905f8d3153885a4c9539dacab044c8554c392ab4f441bb58548720ce85e417
SSDEEP

12288:gY7fh9loCS6KxbxeDuVvFpIHOEuZXKiezfCEKsmKWQYMdP:gafhA96Kx46DpcOEuhKStsz

Score

10^/10

xloader ur06 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ur06

Decoy

philippebrooksdesign.com

cmoorestudio.com

profille-sarina23tammara.club

dqulxe.com

uiffinger.com

nolarapper.com

maconanimalexterminator.com

bisovka.com

loveisloveent.com

datication.com

spxo66.com

drhelpnow.com

ladybug-cle.com

macocome.com

thepoppysocks.com

eldritchparadox.com

mercadolibre.company

ismartfarm.com

kansascarlot.com

kevinld.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4932-137-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe

description	pid	process	target process
PID 5056 set thread context of 4932	5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exed48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe

pid	process
5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
4932	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
4932	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe

description pid process

Token: SeDebugPrivilege 5056 d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe

description	pid	process
Token: SeDebugPrivilege	5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe

description	pid	process	target process
PID 5056 wrote to memory of 4684	5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
PID 5056 wrote to memory of 4684	5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
PID 5056 wrote to memory of 4684	5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
PID 5056 wrote to memory of 1944	5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
PID 5056 wrote to memory of 1944	5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
PID 5056 wrote to memory of 1944	5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
PID 5056 wrote to memory of 4932	5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
PID 5056 wrote to memory of 4932	5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
PID 5056 wrote to memory of 4932	5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
PID 5056 wrote to memory of 4932	5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
PID 5056 wrote to memory of 4932	5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
PID 5056 wrote to memory of 4932	5056	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe	d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe

C:\Users\Admin\AppData\Local\Temp\d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
"C:\Users\Admin\AppData\Local\Temp\d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5056

C:\Users\Admin\AppData\Local\Temp\d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
"C:\Users\Admin\AppData\Local\Temp\d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe"
2⤵
PID:4684

C:\Users\Admin\AppData\Local\Temp\d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
"C:\Users\Admin\AppData\Local\Temp\d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe"
2⤵
PID:1944

C:\Users\Admin\AppData\Local\Temp\d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe
"C:\Users\Admin\AppData\Local\Temp\d48c6eda4d7da385d81986abfc9e091f3498cad3d29adf040eda851f28a10e1a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-135-0x0000000000000000-mapping.dmp

Download
memory/4684-134-0x0000000000000000-mapping.dmp

Download
memory/4932-136-0x0000000000000000-mapping.dmp

Download
memory/4932-137-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4932-139-0x0000000001680000-0x00000000019CA000-memory.dmp

Filesize
3.3MB

Download
memory/5056-132-0x0000000074EC0000-0x0000000075471000-memory.dmp

Filesize
5.7MB

Download
memory/5056-133-0x0000000074EC0000-0x0000000075471000-memory.dmp

Filesize
5.7MB

Download
memory/5056-138-0x0000000074EC0000-0x0000000075471000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads