xloader | d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7

General

Target

d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
Size

422KB
MD5

7904b25e05ab4a27857e1f5a30138149
SHA1

19bc6484ad915f83880f05d1c390ae6f5bbaeccf
SHA256

d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7
SHA512

542a99eaa15983e1876b8bc8766af4d6ad5fdbadb76e67b942ddb25602f9378fae0712a6ef3971afd197ff76c124bbd7bd66e4b0744a9b8770f786a55e83b1f6
SSDEEP

12288:DkVmRzvFXkNaYiG8LLzhXPKF3fDf5gdyC18d5hLtyTA:QVEJXcTiHXVM7fEyC18iTA

Score

10^/10

xloader uidr loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

uidr

Decoy

dulichsongcham.com

cash-royal.com

geneseewildlifetrapping.com

9cc9x79m3y2.com

ntjjzx.com

joinglooko.com

upmchealhtrak.com

hookandcask.com

orca-web.com

ag3holdings.com

empoweredinvestmentstx.com

lustywall.com

rcpelaurentides.com

goyalcoorchidnirvanatwo.homes

iotajinn.com

littlemlive.com

hippocratesbio.com

ashleysema.design

175a45.xyz

bpocompaniesphilippines.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral1/memory/840-56-0x0000000000460000-0x0000000000468000-memory.dmp	CustAttr

Xloader payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1212-62-0x000000000041D000-mapping.dmp	xloader
behavioral1/memory/1212-61-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

description	pid	process	target process
PID 840 set thread context of 1212	840	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exed58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

pid	process
840	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
1212	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

description pid process

Token: SeDebugPrivilege 840 d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

description	pid	process
Token: SeDebugPrivilege	840	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

description	pid	process	target process
PID 840 wrote to memory of 1424	840	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 840 wrote to memory of 1424	840	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 840 wrote to memory of 1424	840	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 840 wrote to memory of 1424	840	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 840 wrote to memory of 1212	840	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 840 wrote to memory of 1212	840	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 840 wrote to memory of 1212	840	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 840 wrote to memory of 1212	840	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 840 wrote to memory of 1212	840	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 840 wrote to memory of 1212	840	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
PID 840 wrote to memory of 1212	840	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe	d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe

C:\Users\Admin\AppData\Local\Temp\d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
"C:\Users\Admin\AppData\Local\Temp\d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840

C:\Users\Admin\AppData\Local\Temp\d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
"C:\Users\Admin\AppData\Local\Temp\d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe"
2⤵
PID:1424

C:\Users\Admin\AppData\Local\Temp\d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe
"C:\Users\Admin\AppData\Local\Temp\d58384baa88b91df65569d660998685f0c05760e201e93461694698d4770b2d7.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1212

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-54-0x0000000000200000-0x0000000000270000-memory.dmp

Filesize
448KB

Download
memory/840-55-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/840-56-0x0000000000460000-0x0000000000468000-memory.dmp

Filesize
32KB

Download
memory/840-57-0x00000000006D0000-0x0000000000728000-memory.dmp

Filesize
352KB

Download
memory/1212-58-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1212-59-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1212-62-0x000000000041D000-mapping.dmp

Download
memory/1212-61-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1212-63-0x0000000000910000-0x0000000000C13000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads