xloader | 75de6a436c06db361958df9e1cd39e7e72e44a8e202058c5dc93233a5b135e6f

General

Target

Confirm received PO 4500640396.exe
Size

1.1MB
MD5

6bca65813eeda79ba5ff4674fd4f831b
SHA1

b2eb4ec39716a2ee523372ad443df85f54ba1fc6
SHA256

2c365b6985fd96e0f9596e0e17370ef537d786473e490dfb144ade8fedc5f2ce
SHA512

026ddb7df5bd8d2c1033372990b9b7faaf3982084ea72528111c22cb149bcc49b141b7031a21df26db152edd55c75fe574d1f9db2bab3cb50f1c3aded2d4df01
SSDEEP

24576:ArFxb7FYgblhBewLhuXmXGrcWx/lND6hEhd73:Kyc1ewLhu1rTNNDWE

Score

10^/10

xloader ipa8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ipa8

Decoy

royalposhpups.com

univa.world

lanerbo.com

shopbabygo.com

theutahhomestore.com

serialmixer.icu

linfeiya.com

xn--12cg3de5c2eb5cyi.com

am-conseil-communication.com

dailygame168.com

therightmilitia.com

visions-agency.com

mapopi.com

frugallyketo.com

guapandglo.com

54w-x126v.net

your-health-kick.com

blockchainhub360.com

registernowhd.xyz

votekellykitashima.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2584-12-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2584-16-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2912-21-0x0000000000070000-0x0000000000099000-memory.dmp	xloader
behavioral1/memory/2912-23-0x0000000000070000-0x0000000000099000-memory.dmp	xloader

Deletes itself 1 IoCs

pid	Process
1948	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2556 set thread context of 2584	2556	Confirm received PO 4500640396.exe	31
PID 2584 set thread context of 1264	2584	Confirm received PO 4500640396.exe	26
PID 2912 set thread context of 1264	2912	cscript.exe	26

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2556	Confirm received PO 4500640396.exe
2584	Confirm received PO 4500640396.exe
2584	Confirm received PO 4500640396.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe
2912	cscript.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2584	Confirm received PO 4500640396.exe
2584	Confirm received PO 4500640396.exe
2584	Confirm received PO 4500640396.exe
2912	cscript.exe
2912	cscript.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	Confirm received PO 4500640396.exe
Token: SeDebugPrivilege	2584	Confirm received PO 4500640396.exe
Token: SeDebugPrivilege	2912	cscript.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2636	2556	Confirm received PO 4500640396.exe	30
PID 2556 wrote to memory of 2636	2556	Confirm received PO 4500640396.exe	30
PID 2556 wrote to memory of 2636	2556	Confirm received PO 4500640396.exe	30
PID 2556 wrote to memory of 2636	2556	Confirm received PO 4500640396.exe	30
PID 2556 wrote to memory of 2584	2556	Confirm received PO 4500640396.exe	31
PID 2556 wrote to memory of 2584	2556	Confirm received PO 4500640396.exe	31
PID 2556 wrote to memory of 2584	2556	Confirm received PO 4500640396.exe	31
PID 2556 wrote to memory of 2584	2556	Confirm received PO 4500640396.exe	31
PID 2556 wrote to memory of 2584	2556	Confirm received PO 4500640396.exe	31
PID 2556 wrote to memory of 2584	2556	Confirm received PO 4500640396.exe	31
PID 2556 wrote to memory of 2584	2556	Confirm received PO 4500640396.exe	31
PID 1264 wrote to memory of 2912	1264	Explorer.EXE	32
PID 1264 wrote to memory of 2912	1264	Explorer.EXE	32
PID 1264 wrote to memory of 2912	1264	Explorer.EXE	32
PID 1264 wrote to memory of 2912	1264	Explorer.EXE	32
PID 2912 wrote to memory of 1948	2912	cscript.exe	34
PID 2912 wrote to memory of 1948	2912	cscript.exe	34
PID 2912 wrote to memory of 1948	2912	cscript.exe	34
PID 2912 wrote to memory of 1948	2912	cscript.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\Confirm received PO 4500640396.exe
  "C:\Users\Admin\AppData\Local\Temp\Confirm received PO 4500640396.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Users\Admin\AppData\Local\Temp\Confirm received PO 4500640396.exe
    "C:\Users\Admin\AppData\Local\Temp\Confirm received PO 4500640396.exe"
    3⤵
    PID:2636
- - C:\Users\Admin\AppData\Local\Temp\Confirm received PO 4500640396.exe
    "C:\Users\Admin\AppData\Local\Temp\Confirm received PO 4500640396.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\SysWOW64\cscript.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Confirm received PO 4500640396.exe"
    3⤵
    - Deletes itself
    PID:1948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1264-26-0x0000000006A30000-0x0000000006B57000-memory.dmp

Filesize
1.2MB

Download
memory/1264-18-0x0000000006A30000-0x0000000006B57000-memory.dmp

Filesize
1.2MB

Download
memory/2556-1-0x00000000748F0000-0x0000000074FDE000-memory.dmp

Filesize
6.9MB

Download
memory/2556-0-0x0000000000D40000-0x0000000000E68000-memory.dmp

Filesize
1.2MB

Download
memory/2556-2-0x0000000004A90000-0x0000000004AD0000-memory.dmp

Filesize
256KB

Download
memory/2556-3-0x0000000000690000-0x00000000006A8000-memory.dmp

Filesize
96KB

Download
memory/2556-4-0x00000000748F0000-0x0000000074FDE000-memory.dmp

Filesize
6.9MB

Download
memory/2556-5-0x0000000004A90000-0x0000000004AD0000-memory.dmp

Filesize
256KB

Download
memory/2556-6-0x0000000007E50000-0x0000000007EF0000-memory.dmp

Filesize
640KB

Download
memory/2556-7-0x0000000002270000-0x000000000229E000-memory.dmp

Filesize
184KB

Download
memory/2556-13-0x00000000748F0000-0x0000000074FDE000-memory.dmp

Filesize
6.9MB

Download
memory/2584-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2584-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2584-14-0x0000000000990000-0x0000000000C93000-memory.dmp

Filesize
3.0MB

Download
memory/2584-16-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2584-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2584-17-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2584-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2912-19-0x0000000000590000-0x00000000005B2000-memory.dmp

Filesize
136KB

Download
memory/2912-20-0x0000000000590000-0x00000000005B2000-memory.dmp

Filesize
136KB

Download
memory/2912-21-0x0000000000070000-0x0000000000099000-memory.dmp

Filesize
164KB

Download
memory/2912-22-0x0000000002260000-0x0000000002563000-memory.dmp

Filesize
3.0MB

Download
memory/2912-23-0x0000000000070000-0x0000000000099000-memory.dmp

Filesize
164KB

Download
memory/2912-25-0x0000000000500000-0x000000000058F000-memory.dmp

Filesize
572KB

Download

Analysis

Sharing