xloader | 31390820ca940a19f0eeaed5b38b27f7cd78317adf40489882b3de038c2ad857

General

Target

11317693065_03162021.exe
Size

847KB
MD5

e079f05837536051b8b3cfa9884a5ff7
SHA1

cf1f565bf2fb23f78948329641f1eafe8a14c078
SHA256

35e50a9d07903f1987a19115dfecdea79cec0844a04883e47106a2969d496ee6
SHA512

12e37b76190748a39aad482b45b9a4aa547695a7c440a2ed2dbd5f10214c7ead3fcfd6e3ac142df29dc431fb53ab906007b5fb21cdf8769e536d641ab9bd3398
SSDEEP

12288:+jmuRRyzFy6YNsIHi3dwIMbHq2Aq19sJHO3mKCHcjQMCY2Y7FNNz+ETv:b86Y9HiNwIymqzsHHcjyYl7FNNaET

Score

10^/10

xloader n58i loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

n58i

Decoy

nl-cafe.com

votetedjaleta.com

britrobertsrealtor.com

globipark.com

citysucces.com

verisignwebsite-verified.com

riddlepc.com

rosecityclimbing.com

oleandrinextract.com

salmankonstruksi.com

needhamchannel.com

refreshx2z.com

youth66.com

pla-russia.com

halloweenmaskpro.com

exdysis.com

1gcz.com

lookgoodman.com

rlxagva.com

stlcityc.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/232-13-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/232-18-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/3064-24-0x0000000001000000-0x0000000001029000-memory.dmp	xloader
behavioral2/memory/3064-26-0x0000000001000000-0x0000000001029000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

Processes:

11317693065_03162021.exeRegSvcs.execmd.exe

description	pid	process	target process
PID 4896 set thread context of 232	4896	11317693065_03162021.exe	RegSvcs.exe
PID 232 set thread context of 3172	232	RegSvcs.exe	Explorer.EXE
PID 3064 set thread context of 3172	3064	cmd.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

RegSvcs.execmd.exe

pid	process
232	RegSvcs.exe
232	RegSvcs.exe
232	RegSvcs.exe
232	RegSvcs.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe
3064	cmd.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

RegSvcs.execmd.exe

pid process

232 RegSvcs.exe
232 RegSvcs.exe
232 RegSvcs.exe
3064 cmd.exe
3064 cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RegSvcs.execmd.exe

description pid process

Token: SeDebugPrivilege 232 RegSvcs.exe
Token: SeDebugPrivilege 3064 cmd.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3172 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	232	RegSvcs.exe
Token: SeDebugPrivilege	3064	cmd.exe

pid	process
3172	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

11317693065_03162021.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 4896 wrote to memory of 232	4896	11317693065_03162021.exe	RegSvcs.exe
PID 4896 wrote to memory of 232	4896	11317693065_03162021.exe	RegSvcs.exe
PID 4896 wrote to memory of 232	4896	11317693065_03162021.exe	RegSvcs.exe
PID 4896 wrote to memory of 232	4896	11317693065_03162021.exe	RegSvcs.exe
PID 4896 wrote to memory of 232	4896	11317693065_03162021.exe	RegSvcs.exe
PID 4896 wrote to memory of 232	4896	11317693065_03162021.exe	RegSvcs.exe
PID 3172 wrote to memory of 3064	3172	Explorer.EXE	cmd.exe
PID 3172 wrote to memory of 3064	3172	Explorer.EXE	cmd.exe
PID 3172 wrote to memory of 3064	3172	Explorer.EXE	cmd.exe
PID 3064 wrote to memory of 4808	3064	cmd.exe	cmd.exe
PID 3064 wrote to memory of 4808	3064	cmd.exe	cmd.exe
PID 3064 wrote to memory of 4808	3064	cmd.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3172

C:\Users\Admin\AppData\Local\Temp\11317693065_03162021.exe
"C:\Users\Admin\AppData\Local\Temp\11317693065_03162021.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:232

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
PID:4808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/232-16-0x0000000000ED0000-0x000000000121A000-memory.dmp

Filesize
3.3MB

Download
memory/232-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/232-13-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/232-19-0x0000000001420000-0x0000000001431000-memory.dmp

Filesize
68KB

Download
memory/3064-23-0x0000000000520000-0x000000000057A000-memory.dmp

Filesize
360KB

Download
memory/3064-28-0x00000000016D0000-0x0000000001760000-memory.dmp

Filesize
576KB

Download
memory/3064-26-0x0000000001000000-0x0000000001029000-memory.dmp

Filesize
164KB

Download
memory/3064-25-0x0000000001870000-0x0000000001BBA000-memory.dmp

Filesize
3.3MB

Download
memory/3064-24-0x0000000001000000-0x0000000001029000-memory.dmp

Filesize
164KB

Download
memory/3064-21-0x0000000000520000-0x000000000057A000-memory.dmp

Filesize
360KB

Download
memory/3172-29-0x0000000008810000-0x00000000089A0000-memory.dmp

Filesize
1.6MB

Download
memory/3172-20-0x0000000008810000-0x00000000089A0000-memory.dmp

Filesize
1.6MB

Download
memory/3172-32-0x00000000089A0000-0x0000000008ABB000-memory.dmp

Filesize
1.1MB

Download
memory/3172-33-0x00000000089A0000-0x0000000008ABB000-memory.dmp

Filesize
1.1MB

Download
memory/3172-36-0x00000000089A0000-0x0000000008ABB000-memory.dmp

Filesize
1.1MB

Download
memory/4896-7-0x0000000005C10000-0x0000000005C66000-memory.dmp

Filesize
344KB

Download
memory/4896-15-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/4896-12-0x0000000007260000-0x0000000007296000-memory.dmp

Filesize
216KB

Download
memory/4896-11-0x0000000007470000-0x0000000007516000-memory.dmp

Filesize
664KB

Download
memory/4896-10-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Filesize
64KB

Download
memory/4896-9-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download
memory/4896-8-0x0000000005E20000-0x0000000005E38000-memory.dmp

Filesize
96KB

Download
memory/4896-0-0x0000000000FD0000-0x00000000010AA000-memory.dmp

Filesize
872KB

Download
memory/4896-6-0x0000000005B00000-0x0000000005B0A000-memory.dmp

Filesize
40KB

Download
memory/4896-5-0x0000000005DF0000-0x0000000005E00000-memory.dmp

Filesize
64KB

Download
memory/4896-4-0x0000000005B70000-0x0000000005C02000-memory.dmp

Filesize
584KB

Download
memory/4896-3-0x0000000006080000-0x0000000006624000-memory.dmp

Filesize
5.6MB

Download
memory/4896-2-0x0000000005A20000-0x0000000005ABC000-memory.dmp

Filesize
624KB

Download
memory/4896-1-0x00000000745F0000-0x0000000074DA0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads