xloader | 15ba7bf101ed22090a8ee76d9a2c306a516a99f1c5045f1846fb039b47497148

General

Target

e6ef3df5d377581da4c454ebb0d5bb40_JaffaCakes118.exe
Size

742KB
MD5

e6ef3df5d377581da4c454ebb0d5bb40
SHA1

2c6562e7772030f60d40615fa2e7348bf84443fc
SHA256

15ba7bf101ed22090a8ee76d9a2c306a516a99f1c5045f1846fb039b47497148
SHA512

29c86c0d497665908b4e97b3688a23d38234e9349d30be74473cfbf433eaa5923604155fe7a9d8b2e584cb0fd4e4df1c5069f8e274714a8964dd58cc60fed8d7
SSDEEP

12288:cdfAtz2iNeHK7zGde0SlNtuSIkrLc+jllj1KQVaQ1QubiOKDmnS2G+W:cc1bykfaSIkrw4X1KcaQr2US2G+

Score

10^/10

xloader q4kr loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

q4kr

Decoy

realmodapk.com

hanoharuka.com

shivalikspiritualproducts.com

womenshealthclinincagra.com

racketpark.com

startuporig.com

azkachinas.com

klanblog.com

linuxradio.tools

siteoficial-liquida.com

glsbuyer.com

bestdeez.com

teens2cash.com

valleyviewconstruct.com

myfortniteskins.com

cambecare.com

csec2011.com

idookap.com

warmwallsrecords.com

smartmirror.one

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/3632-13-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/3632-18-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/1988-23-0x00000000005D0000-0x00000000005F9000-memory.dmp	xloader
behavioral2/memory/1988-25-0x00000000005D0000-0x00000000005F9000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4352 set thread context of 3632	4352	e6ef3df5d377581da4c454ebb0d5bb40_JaffaCakes118.exe	96
PID 3632 set thread context of 3540	3632	RegSvcs.exe	56
PID 1988 set thread context of 3540	1988	msdt.exe	56

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
4352	e6ef3df5d377581da4c454ebb0d5bb40_JaffaCakes118.exe
3632	RegSvcs.exe
3632	RegSvcs.exe
3632	RegSvcs.exe
3632	RegSvcs.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe
1988	msdt.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3632	RegSvcs.exe
3632	RegSvcs.exe
3632	RegSvcs.exe
1988	msdt.exe
1988	msdt.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4352	e6ef3df5d377581da4c454ebb0d5bb40_JaffaCakes118.exe
Token: SeDebugPrivilege	3632	RegSvcs.exe
Token: SeDebugPrivilege	1988	msdt.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3540	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 3632	4352	e6ef3df5d377581da4c454ebb0d5bb40_JaffaCakes118.exe	96
PID 4352 wrote to memory of 3632	4352	e6ef3df5d377581da4c454ebb0d5bb40_JaffaCakes118.exe	96
PID 4352 wrote to memory of 3632	4352	e6ef3df5d377581da4c454ebb0d5bb40_JaffaCakes118.exe	96
PID 4352 wrote to memory of 3632	4352	e6ef3df5d377581da4c454ebb0d5bb40_JaffaCakes118.exe	96
PID 4352 wrote to memory of 3632	4352	e6ef3df5d377581da4c454ebb0d5bb40_JaffaCakes118.exe	96
PID 4352 wrote to memory of 3632	4352	e6ef3df5d377581da4c454ebb0d5bb40_JaffaCakes118.exe	96
PID 3540 wrote to memory of 1988	3540	Explorer.EXE	97
PID 3540 wrote to memory of 1988	3540	Explorer.EXE	97
PID 3540 wrote to memory of 1988	3540	Explorer.EXE	97
PID 1988 wrote to memory of 5004	1988	msdt.exe	98
PID 1988 wrote to memory of 5004	1988	msdt.exe	98
PID 1988 wrote to memory of 5004	1988	msdt.exe	98

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\AppData\Local\Temp\e6ef3df5d377581da4c454ebb0d5bb40_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e6ef3df5d377581da4c454ebb0d5bb40_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- C:\Windows\SysWOW64\msdt.exe
  "C:\Windows\SysWOW64\msdt.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:5004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-21-0x00000000001D0000-0x0000000000227000-memory.dmp

Filesize
348KB

Download
memory/1988-24-0x00000000028D0000-0x0000000002C1A000-memory.dmp

Filesize
3.3MB

Download
memory/1988-22-0x00000000001D0000-0x0000000000227000-memory.dmp

Filesize
348KB

Download
memory/1988-23-0x00000000005D0000-0x00000000005F9000-memory.dmp

Filesize
164KB

Download
memory/1988-27-0x00000000025D0000-0x000000000265F000-memory.dmp

Filesize
572KB

Download
memory/1988-25-0x00000000005D0000-0x00000000005F9000-memory.dmp

Filesize
164KB

Download
memory/3540-34-0x0000000008440000-0x0000000008567000-memory.dmp

Filesize
1.2MB

Download
memory/3540-30-0x0000000008440000-0x0000000008567000-memory.dmp

Filesize
1.2MB

Download
memory/3540-20-0x0000000008260000-0x00000000083EE000-memory.dmp

Filesize
1.6MB

Download
memory/3540-31-0x0000000008440000-0x0000000008567000-memory.dmp

Filesize
1.2MB

Download
memory/3632-16-0x00000000015E0000-0x000000000192A000-memory.dmp

Filesize
3.3MB

Download
memory/3632-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3632-19-0x0000000001070000-0x0000000001080000-memory.dmp

Filesize
64KB

Download
memory/3632-13-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4352-7-0x0000000005300000-0x0000000005356000-memory.dmp

Filesize
344KB

Download
memory/4352-15-0x0000000074E50000-0x0000000075600000-memory.dmp

Filesize
7.7MB

Download
memory/4352-12-0x000000000A8C0000-0x000000000A8EE000-memory.dmp

Filesize
184KB

Download
memory/4352-11-0x0000000008150000-0x00000000081EC000-memory.dmp

Filesize
624KB

Download
memory/4352-10-0x0000000004FF0000-0x0000000005000000-memory.dmp

Filesize
64KB

Download
memory/4352-9-0x0000000074E50000-0x0000000075600000-memory.dmp

Filesize
7.7MB

Download
memory/4352-8-0x0000000005670000-0x0000000005686000-memory.dmp

Filesize
88KB

Download
memory/4352-0-0x0000000000590000-0x0000000000650000-memory.dmp

Filesize
768KB

Download
memory/4352-6-0x0000000005000000-0x000000000500A000-memory.dmp

Filesize
40KB

Download
memory/4352-5-0x0000000004FF0000-0x0000000005000000-memory.dmp

Filesize
64KB

Download
memory/4352-4-0x00000000050F0000-0x0000000005182000-memory.dmp

Filesize
584KB

Download
memory/4352-3-0x00000000056A0000-0x0000000005C44000-memory.dmp

Filesize
5.6MB

Download
memory/4352-1-0x0000000074E50000-0x0000000075600000-memory.dmp

Filesize
7.7MB

Download
memory/4352-2-0x0000000005050000-0x00000000050EC000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing