xloader | c6a43c729575d33894b66ed9072add24ba50d9a48646343956f724c2403ae861

General

Target

Drawings & Related Specifications.exe
Size

500KB
MD5

eb5dd6ea7ec8c4897c3031824637414c
SHA1

d0064d5dff2613aa21a8229492c2c3149ba7ec1d
SHA256

370293d95666a952ba140489c797e3c7d82a92cb400e360f7743075aee04ca10
SHA512

3dfadce944c234dc356961739f528b1a9516a0266d295c90577c506ed73a8693253eabb8f7e231e0f126dfc38039b18c7ddd4ca0c964245c751e54d58615ff00
SSDEEP

12288:vuQ16pHy86FQNTPmjE79nW31TMgTCimkrDqs9gWmKXsD2XN4:116pHy2NTP99W3Sg2ilT9ynu4

Score

10^/10

xloader cvd loader rat

Malware Config

Extracted

Family

xloader

Version

2.1

Campaign

cvd

Decoy

wanda-dutyfree.net

m399999.com

adultoutopico.com

acappellawebradio.com

geetaisprings.com

californiacredit.repair

view-merchant.review

autoritecenter.com

lke7992.com

carroceriasalchichica.com

shanhaishidai.com

wuyounice.com

ahyingshi.com

eurocrypt.net

zvxhs.info

nxsexyvip.com

suffolkbuildingcontrol.com

sotruemobiledetailing.com

bizsolmx.com

personalidea.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/436-5-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral2/memory/436-10-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral2/memory/464-16-0x00000000009C0000-0x00000000009E8000-memory.dmp	xloader

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
76	464	rundll32.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Drawings & Related Specifications.exeDrawings & Related Specifications.exerundll32.exe

description	pid	Process	procid_target
PID 3132 set thread context of 436	3132	Drawings & Related Specifications.exe	110
PID 436 set thread context of 3436	436	Drawings & Related Specifications.exe	56
PID 464 set thread context of 3436	464	rundll32.exe	56

Suspicious behavior: EnumeratesProcesses 47 IoCs

Processes:

Drawings & Related Specifications.exeDrawings & Related Specifications.exerundll32.exe

pid	Process
3132	Drawings & Related Specifications.exe
3132	Drawings & Related Specifications.exe
3132	Drawings & Related Specifications.exe
3132	Drawings & Related Specifications.exe
436	Drawings & Related Specifications.exe
436	Drawings & Related Specifications.exe
436	Drawings & Related Specifications.exe
436	Drawings & Related Specifications.exe
436	Drawings & Related Specifications.exe
436	Drawings & Related Specifications.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe
464	rundll32.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Drawings & Related Specifications.exerundll32.exe

pid	Process
436	Drawings & Related Specifications.exe
436	Drawings & Related Specifications.exe
436	Drawings & Related Specifications.exe
464	rundll32.exe
464	rundll32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

Drawings & Related Specifications.exeDrawings & Related Specifications.exerundll32.exeExplorer.EXE

description	pid	Process
Token: SeDebugPrivilege	3132	Drawings & Related Specifications.exe
Token: SeDebugPrivilege	436	Drawings & Related Specifications.exe
Token: SeDebugPrivilege	464	rundll32.exe
Token: SeShutdownPrivilege	3436	Explorer.EXE
Token: SeCreatePagefilePrivilege	3436	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid	Process
3436	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Drawings & Related Specifications.exeExplorer.EXErundll32.exe

description	pid	Process	procid_target
PID 3132 wrote to memory of 4740	3132	Drawings & Related Specifications.exe	109
PID 3132 wrote to memory of 4740	3132	Drawings & Related Specifications.exe	109
PID 3132 wrote to memory of 4740	3132	Drawings & Related Specifications.exe	109
PID 3132 wrote to memory of 436	3132	Drawings & Related Specifications.exe	110
PID 3132 wrote to memory of 436	3132	Drawings & Related Specifications.exe	110
PID 3132 wrote to memory of 436	3132	Drawings & Related Specifications.exe	110
PID 3132 wrote to memory of 436	3132	Drawings & Related Specifications.exe	110
PID 3132 wrote to memory of 436	3132	Drawings & Related Specifications.exe	110
PID 3132 wrote to memory of 436	3132	Drawings & Related Specifications.exe	110
PID 3436 wrote to memory of 464	3436	Explorer.EXE	111
PID 3436 wrote to memory of 464	3436	Explorer.EXE	111
PID 3436 wrote to memory of 464	3436	Explorer.EXE	111
PID 464 wrote to memory of 4520	464	rundll32.exe	112
PID 464 wrote to memory of 4520	464	rundll32.exe	112
PID 464 wrote to memory of 4520	464	rundll32.exe	112

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Users\Admin\AppData\Local\Temp\Drawings & Related Specifications.exe
  "C:\Users\Admin\AppData\Local\Temp\Drawings & Related Specifications.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Users\Admin\AppData\Local\Temp\Drawings & Related Specifications.exe
    "C:\Users\Admin\AppData\Local\Temp\Drawings & Related Specifications.exe"
    3⤵
    PID:4740
- - C:\Users\Admin\AppData\Local\Temp\Drawings & Related Specifications.exe
    "C:\Users\Admin\AppData\Local\Temp\Drawings & Related Specifications.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:436
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\SysWOW64\rundll32.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Drawings & Related Specifications.exe"
    3⤵
    PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2700,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:8
1⤵
PID:4468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/436-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/436-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/436-11-0x0000000000B10000-0x0000000000B20000-memory.dmp

Filesize
64KB

Download
memory/436-8-0x0000000001120000-0x000000000146A000-memory.dmp

Filesize
3.3MB

Download
memory/464-15-0x00000000005E0000-0x00000000005F4000-memory.dmp

Filesize
80KB

Download
memory/464-13-0x00000000005E0000-0x00000000005F4000-memory.dmp

Filesize
80KB

Download
memory/464-16-0x00000000009C0000-0x00000000009E8000-memory.dmp

Filesize
160KB

Download
memory/3132-2-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/3132-4-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/3132-1-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/3132-3-0x0000000075362000-0x0000000075363000-memory.dmp

Filesize
4KB

Download
memory/3132-0-0x0000000075362000-0x0000000075363000-memory.dmp

Filesize
4KB

Download
memory/3132-7-0x0000000075360000-0x0000000075911000-memory.dmp

Filesize
5.7MB

Download
memory/3436-12-0x00000000091A0000-0x0000000009327000-memory.dmp

Filesize
1.5MB

Download
memory/3436-18-0x00000000091A0000-0x0000000009327000-memory.dmp

Filesize
1.5MB

Download
memory/3436-20-0x0000000003330000-0x0000000003443000-memory.dmp

Filesize
1.1MB

Download
memory/3436-21-0x0000000003330000-0x0000000003443000-memory.dmp

Filesize
1.1MB

Download
memory/3436-25-0x0000000003330000-0x0000000003443000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads