xloader | ad448bb6ae092edc75f674601f4cffefcb02a017390ec76359e7e8191bedef70

General

Target

a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
Size

356KB
MD5

cb94f8bf4453d77ed35b4cccad18260c
SHA1

aeacb009addb2152c05a34537f565e66b32b25d2
SHA256

a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466
SHA512

7fb17a554481d5ff6c28edd4ee43b9306a8e59ac9f992a2b6d243b2d88eb9daa997bbf5be962f331c6ec282b15e4e67107c233691a6b05d317957072754f4135
SSDEEP

6144:lZwkVnw0KesTf8DZgu2OuQ15Mgkv0StJXgBivzsXjpY/i0un1IC1ewYrbOhpRRRY:lZ7Laf8DqOrRk8+JXUMzeYRun19ewskC

Score

10^/10

xloader c6si loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

c6si

Decoy

tristateinc.construction

americanscaregroundstexas.com

kanimisoshiru.com

wihling.com

fishcheekstosa.com

parentsfuid.com

greenstandmarket.com

fc8fla8kzq.com

gametwist-83.club

jobsncvs.com

directrealtysells.com

avida2015.com

conceptasite.net

arkaneattire.com

indev-mobility.info

2160centurypark412.com

valefloor.com

septembership.com

stackflix.com

jimc0sales.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1580-140-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe

description	pid	process	target process
PID 544 set thread context of 1580	544	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exea39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe

pid	process
544	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
544	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
1580	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
1580	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe

description pid process

Token: SeDebugPrivilege 544 a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe

description	pid	process
Token: SeDebugPrivilege	544	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe

description	pid	process	target process
PID 544 wrote to memory of 1652	544	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
PID 544 wrote to memory of 1652	544	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
PID 544 wrote to memory of 1652	544	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
PID 544 wrote to memory of 1580	544	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
PID 544 wrote to memory of 1580	544	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
PID 544 wrote to memory of 1580	544	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
PID 544 wrote to memory of 1580	544	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
PID 544 wrote to memory of 1580	544	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
PID 544 wrote to memory of 1580	544	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe	a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe

C:\Users\Admin\AppData\Local\Temp\a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
"C:\Users\Admin\AppData\Local\Temp\a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544

C:\Users\Admin\AppData\Local\Temp\a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
"C:\Users\Admin\AppData\Local\Temp\a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe"
2⤵
PID:1652

C:\Users\Admin\AppData\Local\Temp\a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe
"C:\Users\Admin\AppData\Local\Temp\a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/544-133-0x0000000000F80000-0x0000000000FE0000-memory.dmp

Filesize
384KB

Download
memory/544-134-0x0000000005E70000-0x0000000006414000-memory.dmp

Filesize
5.6MB

Download
memory/544-135-0x00000000059A0000-0x0000000005A32000-memory.dmp

Filesize
584KB

Download
memory/544-136-0x0000000005C20000-0x0000000005C30000-memory.dmp

Filesize
64KB

Download
memory/544-137-0x0000000005B30000-0x0000000005B3A000-memory.dmp

Filesize
40KB

Download
memory/544-138-0x0000000005C20000-0x0000000005C30000-memory.dmp

Filesize
64KB

Download
memory/544-139-0x0000000008E50000-0x0000000008EEC000-memory.dmp

Filesize
624KB

Download
memory/1580-140-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1580-142-0x0000000001580000-0x00000000018CA000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads