xloader | 0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6

General

Target

0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe
Size

625KB
MD5

bfffa6d9e4e9c9b6884ed93b7ccf8f25
SHA1

a48dbb1c2c882b90d21a7a43ebb2892e6ba5d707
SHA256

0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6
SHA512

d29a5dc9294c950a814f364d3b0cfb9be6f5b2de686d8bf82b3534ef3a5bb6b159e0bdf7130d3588236e99ee2588baf53c1c2685bc527b1164c9699660adf4ab
SSDEEP

12288:XnNEki9qepcHd9GNGfvy8ustQmNrcODG7wfTX6w3eN18Anj:Xn/i8rd9GQvCs7AoeiFu84j

Score

10^/10

xloader uszn loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

uszn

Decoy

animegriptape.com

pcpnetworks.com

putupmybabyforadoption.com

xn--jvrr98g37n88d.com

fertinvitro.doctor

undonethread.com

avoleague.com

sissysundays.com

guilhermeoliveiro.site

catholicon-bespeckle.info

mardesuenosfundacion.com

songkhoe24.site

shoecityindia.com

smallbathroomdecor.info

tskusa.com

prairiespringsllc.com

kegncoffee.com

clicklounge.xyz

catholicendoflifeplanning.com

steelobzee.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/588-61-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/588-62-0x000000000041D0F0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe

description	pid	process	target process
PID 1736 set thread context of 588	1736	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe

pid	process
1736	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe
1736	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe
588	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe

description pid process

Token: SeDebugPrivilege 1736 0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe

description	pid	process
Token: SeDebugPrivilege	1736	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe

description	pid	process	target process
PID 1736 wrote to memory of 568	1736	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe
PID 1736 wrote to memory of 568	1736	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe
PID 1736 wrote to memory of 568	1736	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe
PID 1736 wrote to memory of 568	1736	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe
PID 1736 wrote to memory of 588	1736	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe
PID 1736 wrote to memory of 588	1736	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe
PID 1736 wrote to memory of 588	1736	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe
PID 1736 wrote to memory of 588	1736	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe
PID 1736 wrote to memory of 588	1736	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe
PID 1736 wrote to memory of 588	1736	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe
PID 1736 wrote to memory of 588	1736	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe	0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe

C:\Users\Admin\AppData\Local\Temp\0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe
"C:\Users\Admin\AppData\Local\Temp\0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736

C:\Users\Admin\AppData\Local\Temp\0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe
"{path}"
2⤵
PID:568

C:\Users\Admin\AppData\Local\Temp\0e350d65e65fef65f4dd866e8641f27423a0c2f43161f191f87310c2234c1fd6.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:588

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/588-58-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/588-59-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/588-61-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/588-62-0x000000000041D0F0-mapping.dmp

Download
memory/588-63-0x00000000009C0000-0x0000000000CC3000-memory.dmp

Filesize
3.0MB

Download
memory/1736-54-0x0000000000DA0000-0x0000000000E42000-memory.dmp

Filesize
648KB

Download
memory/1736-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1736-56-0x0000000000360000-0x0000000000372000-memory.dmp

Filesize
72KB

Download
memory/1736-57-0x0000000007EF0000-0x0000000007F76000-memory.dmp

Filesize
536KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads