xloader | 247ddda6e2702472217bec887b6e53bbf355e63d45753b4227956ea3e5a0272e

Analysis

max time kernel
155s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/bckkx.dll
Size

42KB
MD5

eaddca0182a37dcadc481a26307ad111
SHA1

a7aef3dcbd7fffedc716dc70610a1f0f62fcaf42
SHA256

a62639b271e480d9aa28d50945051ae35577711d95702f270060d809b062bb56
SHA512

9409069ca080c0170a70ec7e5baf7dd4c959362c9f540d525f45644ed95012f87b6818b16085bff2e1ae843281be97183372b8b0721673720bb76e93a5704c3d
SSDEEP

768:Tk9vanYHr7T9FE4FiAGKzgVTpQJTvRTyzFEjuRAkwYY7m6:Tk9uYL7hVG1amFEjuRAFYY7m6

Score

10^/10

xloader dgt9 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

dgt9

Decoy

glimpse-media.com

crimsongomidv.xyz

seo-clicks6.com

cloudbreakhq.com

oakabbey.net

findcasinoslots.com

thehelloloveshop.com

havetsuczyli.quest

celestialtransportation.net

nianlun.wiki

valentinaturals.com

808gang.net

tykaa.com

sparoom.store

empregosbr1.online

visaractivateddprocessing.com

industriamadereraargentina.com

ekopressbrake.com

984561.com

oklahomacasinoreviews.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 4 IoCs

rat

resource	yara_rule
behavioral4/memory/3308-1-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral4/memory/3308-5-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral4/memory/4784-11-0x0000000000760000-0x0000000000789000-memory.dmp	xloader
behavioral4/memory/4784-13-0x0000000000760000-0x0000000000789000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4092 set thread context of 3308	4092	rundll32.exe	88
PID 3308 set thread context of 3492	3308	rundll32.exe	57
PID 4784 set thread context of 3492	4784	rundll32.exe	57

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
3308	rundll32.exe
3308	rundll32.exe
3308	rundll32.exe
3308	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3308	rundll32.exe
3308	rundll32.exe
3308	rundll32.exe
4784	rundll32.exe
4784	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3308	rundll32.exe
Token: SeDebugPrivilege	4784	rundll32.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3492	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 4092	2344	rundll32.exe	85
PID 2344 wrote to memory of 4092	2344	rundll32.exe	85
PID 2344 wrote to memory of 4092	2344	rundll32.exe	85
PID 4092 wrote to memory of 3308	4092	rundll32.exe	88
PID 4092 wrote to memory of 3308	4092	rundll32.exe	88
PID 4092 wrote to memory of 3308	4092	rundll32.exe	88
PID 4092 wrote to memory of 3308	4092	rundll32.exe	88
PID 4092 wrote to memory of 3308	4092	rundll32.exe	88
PID 4092 wrote to memory of 3308	4092	rundll32.exe	88
PID 3492 wrote to memory of 4784	3492	Explorer.EXE	90
PID 3492 wrote to memory of 4784	3492	Explorer.EXE	90
PID 3492 wrote to memory of 4784	3492	Explorer.EXE	90
PID 4784 wrote to memory of 4136	4784	rundll32.exe	95
PID 4784 wrote to memory of 4136	4784	rundll32.exe	95
PID 4784 wrote to memory of 4136	4784	rundll32.exe	95

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bckkx.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bckkx.dll,#1
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bckkx.dll,#1
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:3308
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\SysWOW64\rundll32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\SysWOW64\rundll32.exe"
    3⤵
    PID:4136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3308-1-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3308-3-0x0000000002F90000-0x00000000032DA000-memory.dmp

Filesize
3.3MB

Download
memory/3308-5-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3308-6-0x0000000002EF0000-0x0000000002F01000-memory.dmp

Filesize
68KB

Download
memory/3492-18-0x0000000008530000-0x00000000086BB000-memory.dmp

Filesize
1.5MB

Download
memory/3492-7-0x0000000007D70000-0x0000000007F0F000-memory.dmp

Filesize
1.6MB

Download
memory/3492-22-0x0000000008530000-0x00000000086BB000-memory.dmp

Filesize
1.5MB

Download
memory/3492-19-0x0000000008530000-0x00000000086BB000-memory.dmp

Filesize
1.5MB

Download
memory/4092-2-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4092-0-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4784-10-0x0000000000FC0000-0x0000000000FD4000-memory.dmp

Filesize
80KB

Download
memory/4784-13-0x0000000000760000-0x0000000000789000-memory.dmp

Filesize
164KB

Download
memory/4784-15-0x0000000002710000-0x00000000027A0000-memory.dmp

Filesize
576KB

Download
memory/4784-12-0x00000000028F0000-0x0000000002C3A000-memory.dmp

Filesize
3.3MB

Download
memory/4784-11-0x0000000000760000-0x0000000000789000-memory.dmp

Filesize
164KB

Download
memory/4784-8-0x0000000000FC0000-0x0000000000FD4000-memory.dmp

Filesize
80KB

Download