xloader | 75de6a436c06db361958df9e1cd39e7e72e44a8e202058c5dc93233a5b135e6f

General

Target

Confirm received PO 4500640396.exe
Size

1.1MB
MD5

6bca65813eeda79ba5ff4674fd4f831b
SHA1

b2eb4ec39716a2ee523372ad443df85f54ba1fc6
SHA256

2c365b6985fd96e0f9596e0e17370ef537d786473e490dfb144ade8fedc5f2ce
SHA512

026ddb7df5bd8d2c1033372990b9b7faaf3982084ea72528111c22cb149bcc49b141b7031a21df26db152edd55c75fe574d1f9db2bab3cb50f1c3aded2d4df01
SSDEEP

24576:ArFxb7FYgblhBewLhuXmXGrcWx/lND6hEhd73:Kyc1ewLhu1rTNNDWE

Score

10^/10

xloader ipa8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ipa8

Decoy

royalposhpups.com

univa.world

lanerbo.com

shopbabygo.com

theutahhomestore.com

serialmixer.icu

linfeiya.com

xn--12cg3de5c2eb5cyi.com

am-conseil-communication.com

dailygame168.com

therightmilitia.com

visions-agency.com

mapopi.com

frugallyketo.com

guapandglo.com

54w-x126v.net

your-health-kick.com

blockchainhub360.com

registernowhd.xyz

votekellykitashima.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/4408-13-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/4408-18-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/3532-23-0x0000000001220000-0x0000000001249000-memory.dmp	xloader
behavioral2/memory/3532-25-0x0000000001220000-0x0000000001249000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1052 set thread context of 4408	1052	Confirm received PO 4500640396.exe	104
PID 4408 set thread context of 3304	4408	Confirm received PO 4500640396.exe	49
PID 3532 set thread context of 3304	3532	colorcpl.exe	49

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
4408	Confirm received PO 4500640396.exe
4408	Confirm received PO 4500640396.exe
4408	Confirm received PO 4500640396.exe
4408	Confirm received PO 4500640396.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe
3532	colorcpl.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4408	Confirm received PO 4500640396.exe
4408	Confirm received PO 4500640396.exe
4408	Confirm received PO 4500640396.exe
3532	colorcpl.exe
3532	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	Confirm received PO 4500640396.exe
Token: SeDebugPrivilege	3532	colorcpl.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3304	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 4408	1052	Confirm received PO 4500640396.exe	104
PID 1052 wrote to memory of 4408	1052	Confirm received PO 4500640396.exe	104
PID 1052 wrote to memory of 4408	1052	Confirm received PO 4500640396.exe	104
PID 1052 wrote to memory of 4408	1052	Confirm received PO 4500640396.exe	104
PID 1052 wrote to memory of 4408	1052	Confirm received PO 4500640396.exe	104
PID 1052 wrote to memory of 4408	1052	Confirm received PO 4500640396.exe	104
PID 3304 wrote to memory of 3532	3304	Explorer.EXE	105
PID 3304 wrote to memory of 3532	3304	Explorer.EXE	105
PID 3304 wrote to memory of 3532	3304	Explorer.EXE	105
PID 3532 wrote to memory of 392	3532	colorcpl.exe	107
PID 3532 wrote to memory of 392	3532	colorcpl.exe	107
PID 3532 wrote to memory of 392	3532	colorcpl.exe	107

C:\Users\Admin\AppData\Local\Temp\Confirm received PO 4500640396.exe
"C:\Users\Admin\AppData\Local\Temp\Confirm received PO 4500640396.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Users\Admin\AppData\Local\Temp\Confirm received PO 4500640396.exe
  "C:\Users\Admin\AppData\Local\Temp\Confirm received PO 4500640396.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:4408

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\SysWOW64\colorcpl.exe
  "C:\Windows\SysWOW64\colorcpl.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Confirm received PO 4500640396.exe"
    3⤵
    PID:392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1052-15-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/1052-4-0x0000000004D30000-0x0000000004DC2000-memory.dmp

Filesize
584KB

Download
memory/1052-1-0x00000000000D0000-0x00000000001F8000-memory.dmp

Filesize
1.2MB

Download
memory/1052-3-0x0000000005240000-0x00000000057E4000-memory.dmp

Filesize
5.6MB

Download
memory/1052-11-0x0000000007B40000-0x0000000007BE0000-memory.dmp

Filesize
640KB

Download
memory/1052-5-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/1052-6-0x0000000004C90000-0x0000000004C9A000-memory.dmp

Filesize
40KB

Download
memory/1052-7-0x0000000004DD0000-0x0000000004E26000-memory.dmp

Filesize
344KB

Download
memory/1052-8-0x0000000005020000-0x0000000005038000-memory.dmp

Filesize
96KB

Download
memory/1052-9-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/1052-10-0x0000000004E80000-0x0000000004E90000-memory.dmp

Filesize
64KB

Download
memory/1052-2-0x0000000004BF0000-0x0000000004C8C000-memory.dmp

Filesize
624KB

Download
memory/1052-12-0x000000000A2B0000-0x000000000A2DE000-memory.dmp

Filesize
184KB

Download
memory/1052-0-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/3304-20-0x0000000006C00000-0x0000000006D3E000-memory.dmp

Filesize
1.2MB

Download
memory/3304-35-0x00000000081F0000-0x0000000008357000-memory.dmp

Filesize
1.4MB

Download
memory/3304-32-0x00000000081F0000-0x0000000008357000-memory.dmp

Filesize
1.4MB

Download
memory/3304-31-0x00000000081F0000-0x0000000008357000-memory.dmp

Filesize
1.4MB

Download
memory/3304-28-0x0000000006C00000-0x0000000006D3E000-memory.dmp

Filesize
1.2MB

Download
memory/3532-22-0x0000000000A50000-0x0000000000A69000-memory.dmp

Filesize
100KB

Download
memory/3532-21-0x0000000000A50000-0x0000000000A69000-memory.dmp

Filesize
100KB

Download
memory/3532-24-0x0000000003210000-0x000000000355A000-memory.dmp

Filesize
3.3MB

Download
memory/3532-25-0x0000000001220000-0x0000000001249000-memory.dmp

Filesize
164KB

Download
memory/3532-27-0x0000000003160000-0x00000000031EF000-memory.dmp

Filesize
572KB

Download
memory/3532-23-0x0000000001220000-0x0000000001249000-memory.dmp

Filesize
164KB

Download
memory/4408-13-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4408-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4408-16-0x0000000001740000-0x0000000001A8A000-memory.dmp

Filesize
3.3MB

Download
memory/4408-19-0x0000000001290000-0x00000000012A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing