xloader | c6a43c729575d33894b66ed9072add24ba50d9a48646343956f724c2403ae861

General

Target

Drawings & Related Specifications.exe
Size

500KB
MD5

eb5dd6ea7ec8c4897c3031824637414c
SHA1

d0064d5dff2613aa21a8229492c2c3149ba7ec1d
SHA256

370293d95666a952ba140489c797e3c7d82a92cb400e360f7743075aee04ca10
SHA512

3dfadce944c234dc356961739f528b1a9516a0266d295c90577c506ed73a8693253eabb8f7e231e0f126dfc38039b18c7ddd4ca0c964245c751e54d58615ff00
SSDEEP

12288:vuQ16pHy86FQNTPmjE79nW31TMgTCimkrDqs9gWmKXsD2XN4:116pHy2NTP99W3Sg2ilT9ynu4

Score

10^/10

xloader cvd loader rat

Malware Config

Extracted

Family

xloader

Version

2.1

Campaign

cvd

Decoy

wanda-dutyfree.net

m399999.com

adultoutopico.com

acappellawebradio.com

geetaisprings.com

californiacredit.repair

view-merchant.review

autoritecenter.com

lke7992.com

carroceriasalchichica.com

shanhaishidai.com

wuyounice.com

ahyingshi.com

eurocrypt.net

zvxhs.info

nxsexyvip.com

suffolkbuildingcontrol.com

sotruemobiledetailing.com

bizsolmx.com

personalidea.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2444-11-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/2444-15-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/2200-21-0x0000000000080000-0x00000000000A8000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2704 cmd.exe

pid	process
2704	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Drawings & Related Specifications.exeDrawings & Related Specifications.exewlanext.exe

description	pid	process	target process
PID 1756 set thread context of 2444	1756	Drawings & Related Specifications.exe	Drawings & Related Specifications.exe
PID 2444 set thread context of 1212	2444	Drawings & Related Specifications.exe	Explorer.EXE
PID 2200 set thread context of 1212	2200	wlanext.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

Drawings & Related Specifications.exeDrawings & Related Specifications.exewlanext.exe

pid	process
1756	Drawings & Related Specifications.exe
1756	Drawings & Related Specifications.exe
2444	Drawings & Related Specifications.exe
2444	Drawings & Related Specifications.exe
2200	wlanext.exe
2200	wlanext.exe
2200	wlanext.exe
2200	wlanext.exe
2200	wlanext.exe
2200	wlanext.exe
2200	wlanext.exe
2200	wlanext.exe
2200	wlanext.exe
2200	wlanext.exe
2200	wlanext.exe
2200	wlanext.exe
2200	wlanext.exe
2200	wlanext.exe
2200	wlanext.exe
2200	wlanext.exe
2200	wlanext.exe
2200	wlanext.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Drawings & Related Specifications.exewlanext.exe

pid process

2444 Drawings & Related Specifications.exe
2444 Drawings & Related Specifications.exe
2444 Drawings & Related Specifications.exe
2200 wlanext.exe
2200 wlanext.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Drawings & Related Specifications.exeDrawings & Related Specifications.exewlanext.exe

description pid process

Token: SeDebugPrivilege 1756 Drawings & Related Specifications.exe
Token: SeDebugPrivilege 2444 Drawings & Related Specifications.exe
Token: SeDebugPrivilege 2200 wlanext.exe

pid	process
2444	Drawings & Related Specifications.exe
2444	Drawings & Related Specifications.exe
2444	Drawings & Related Specifications.exe
2200	wlanext.exe
2200	wlanext.exe

description	pid	process
Token: SeDebugPrivilege	1756	Drawings & Related Specifications.exe
Token: SeDebugPrivilege	2444	Drawings & Related Specifications.exe
Token: SeDebugPrivilege	2200	wlanext.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

Drawings & Related Specifications.exeExplorer.EXEwlanext.exe

description	pid	process	target process
PID 1756 wrote to memory of 2504	1756	Drawings & Related Specifications.exe	Drawings & Related Specifications.exe
PID 1756 wrote to memory of 2504	1756	Drawings & Related Specifications.exe	Drawings & Related Specifications.exe
PID 1756 wrote to memory of 2504	1756	Drawings & Related Specifications.exe	Drawings & Related Specifications.exe
PID 1756 wrote to memory of 2504	1756	Drawings & Related Specifications.exe	Drawings & Related Specifications.exe
PID 1756 wrote to memory of 2444	1756	Drawings & Related Specifications.exe	Drawings & Related Specifications.exe
PID 1756 wrote to memory of 2444	1756	Drawings & Related Specifications.exe	Drawings & Related Specifications.exe
PID 1756 wrote to memory of 2444	1756	Drawings & Related Specifications.exe	Drawings & Related Specifications.exe
PID 1756 wrote to memory of 2444	1756	Drawings & Related Specifications.exe	Drawings & Related Specifications.exe
PID 1756 wrote to memory of 2444	1756	Drawings & Related Specifications.exe	Drawings & Related Specifications.exe
PID 1756 wrote to memory of 2444	1756	Drawings & Related Specifications.exe	Drawings & Related Specifications.exe
PID 1756 wrote to memory of 2444	1756	Drawings & Related Specifications.exe	Drawings & Related Specifications.exe
PID 1212 wrote to memory of 2200	1212	Explorer.EXE	wlanext.exe
PID 1212 wrote to memory of 2200	1212	Explorer.EXE	wlanext.exe
PID 1212 wrote to memory of 2200	1212	Explorer.EXE	wlanext.exe
PID 1212 wrote to memory of 2200	1212	Explorer.EXE	wlanext.exe
PID 2200 wrote to memory of 2704	2200	wlanext.exe	cmd.exe
PID 2200 wrote to memory of 2704	2200	wlanext.exe	cmd.exe
PID 2200 wrote to memory of 2704	2200	wlanext.exe	cmd.exe
PID 2200 wrote to memory of 2704	2200	wlanext.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1212

C:\Users\Admin\AppData\Local\Temp\Drawings & Related Specifications.exe
"C:\Users\Admin\AppData\Local\Temp\Drawings & Related Specifications.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756

C:\Users\Admin\AppData\Local\Temp\Drawings & Related Specifications.exe
"C:\Users\Admin\AppData\Local\Temp\Drawings & Related Specifications.exe"
3⤵
PID:2504

C:\Users\Admin\AppData\Local\Temp\Drawings & Related Specifications.exe
"C:\Users\Admin\AppData\Local\Temp\Drawings & Related Specifications.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Drawings & Related Specifications.exe"
3⤵
- Deletes itself
PID:2704

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-17-0x0000000004010000-0x0000000004210000-memory.dmp

Filesize
2.0MB

Download
memory/1212-23-0x0000000004430000-0x00000000044EA000-memory.dmp

Filesize
744KB

Download
memory/1212-18-0x0000000004430000-0x00000000044EA000-memory.dmp

Filesize
744KB

Download
memory/1756-1-0x00000000744A0000-0x0000000074A4B000-memory.dmp

Filesize
5.7MB

Download
memory/1756-2-0x00000000744A0000-0x0000000074A4B000-memory.dmp

Filesize
5.7MB

Download
memory/1756-3-0x00000000744A0000-0x0000000074A4B000-memory.dmp

Filesize
5.7MB

Download
memory/1756-4-0x00000000744A0000-0x0000000074A4B000-memory.dmp

Filesize
5.7MB

Download
memory/1756-0-0x00000000744A1000-0x00000000744A2000-memory.dmp

Filesize
4KB

Download
memory/1756-12-0x00000000744A0000-0x0000000074A4B000-memory.dmp

Filesize
5.7MB

Download
memory/2200-21-0x0000000000080000-0x00000000000A8000-memory.dmp

Filesize
160KB

Download
memory/2200-19-0x0000000000250000-0x0000000000266000-memory.dmp

Filesize
88KB

Download
memory/2200-20-0x0000000000250000-0x0000000000266000-memory.dmp

Filesize
88KB

Download
memory/2444-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2444-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2444-16-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2444-13-0x00000000009E0000-0x0000000000CE3000-memory.dmp

Filesize
3.0MB

Download
memory/2444-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2444-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2444-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads