xloader | 505d119d07ae831d54801a1a5c39320ec8bbeec8c4ad81f2b60e12ae25b88f8f

General

Target

New Order.exe
Size

464KB
MD5

0024d9cde1a84611d54766483e965b83
SHA1

c2510602e2894aeb2882fb88b56b0240b068cbe3
SHA256

505d119d07ae831d54801a1a5c39320ec8bbeec8c4ad81f2b60e12ae25b88f8f
SHA512

88c2cb84c52cb77a97aac1ad6dfa8df7ec5f6ddfaa98151ceff84b8251d6fa35e5a396fd8ad1e64e401e9f2867afb8625fce0c8ae023875172a520014582b918

Score

10^/10

xloader agilenet loader rat

Malware Config

Extracted

Family

xloader

C2

http://www.magentos.info/za004/

Decoy

meihebiotech.com

4clicksecurewipe.com

essentially-best.life

real-castings.com

ivetha.com

hczx618.com

1990sinsertcarddatabase.com

testdrive.digital

johanneroussy.com

lyhyzl.com

ajekj.com

mikima.site

tennisfaction.com

fwril.info

hancockinstituteofjazz.info

nespressoonline.com

zeehostonline.com

academychic.com

1nha.com

moneylinetees.online

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1068-11-0x0000000000400000-0x0000000000427000-memory.dmp	xloader
behavioral1/memory/1068-12-0x000000000041C150-mapping.dmp	xloader
behavioral1/memory/1072-22-0x0000000000080000-0x00000000000A7000-memory.dmp	xloader

Executes dropped EXE 1 IoCs

Processes:

AddInProcess32.exe

pid process

1068 AddInProcess32.exe
Loads dropped DLL 1 IoCs

Processes:

New Order.exe

pid process

1648 New Order.exe

pid	process
1068	AddInProcess32.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/1648-7-0x0000000000450000-0x000000000045A000-memory.dmp	agile_net

Suspicious use of SetThreadContext 4 IoCs

Processes:

New Order.exeAddInProcess32.exeNAPSTAT.EXE

description	pid	process	target process
PID 1648 set thread context of 1068	1648	New Order.exe	AddInProcess32.exe
PID 1068 set thread context of 1268	1068	AddInProcess32.exe	Explorer.EXE
PID 1068 set thread context of 1268	1068	AddInProcess32.exe	Explorer.EXE
PID 1072 set thread context of 1268	1072	NAPSTAT.EXE	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

New Order.exeAddInProcess32.exeNAPSTAT.EXE

pid	process
1648	New Order.exe
1648	New Order.exe
1648	New Order.exe
1068	AddInProcess32.exe
1068	AddInProcess32.exe
1068	AddInProcess32.exe
1072	NAPSTAT.EXE
1072	NAPSTAT.EXE
1072	NAPSTAT.EXE
1072	NAPSTAT.EXE
1072	NAPSTAT.EXE
1072	NAPSTAT.EXE
1072	NAPSTAT.EXE
1072	NAPSTAT.EXE
1072	NAPSTAT.EXE
1072	NAPSTAT.EXE
1072	NAPSTAT.EXE
1072	NAPSTAT.EXE
1072	NAPSTAT.EXE
1072	NAPSTAT.EXE
1072	NAPSTAT.EXE
1072	NAPSTAT.EXE
1072	NAPSTAT.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

AddInProcess32.exeNAPSTAT.EXE

pid process

1068 AddInProcess32.exe
1068 AddInProcess32.exe
1068 AddInProcess32.exe
1068 AddInProcess32.exe
1072 NAPSTAT.EXE
1072 NAPSTAT.EXE
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

New Order.exeAddInProcess32.exeNAPSTAT.EXE

description pid process

Token: SeDebugPrivilege 1648 New Order.exe
Token: SeDebugPrivilege 1068 AddInProcess32.exe
Token: SeDebugPrivilege 1072 NAPSTAT.EXE
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE

pid	process
1068	AddInProcess32.exe
1068	AddInProcess32.exe
1068	AddInProcess32.exe
1068	AddInProcess32.exe
1072	NAPSTAT.EXE
1072	NAPSTAT.EXE

description	pid	process
Token: SeDebugPrivilege	1648	New Order.exe
Token: SeDebugPrivilege	1068	AddInProcess32.exe
Token: SeDebugPrivilege	1072	NAPSTAT.EXE

pid	process
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE

pid	process
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

New Order.exeExplorer.EXENAPSTAT.EXE

description	pid	process	target process
PID 1648 wrote to memory of 1068	1648	New Order.exe	AddInProcess32.exe
PID 1648 wrote to memory of 1068	1648	New Order.exe	AddInProcess32.exe
PID 1648 wrote to memory of 1068	1648	New Order.exe	AddInProcess32.exe
PID 1648 wrote to memory of 1068	1648	New Order.exe	AddInProcess32.exe
PID 1648 wrote to memory of 1068	1648	New Order.exe	AddInProcess32.exe
PID 1648 wrote to memory of 1068	1648	New Order.exe	AddInProcess32.exe
PID 1648 wrote to memory of 1068	1648	New Order.exe	AddInProcess32.exe
PID 1268 wrote to memory of 1072	1268	Explorer.EXE	NAPSTAT.EXE
PID 1268 wrote to memory of 1072	1268	Explorer.EXE	NAPSTAT.EXE
PID 1268 wrote to memory of 1072	1268	Explorer.EXE	NAPSTAT.EXE
PID 1268 wrote to memory of 1072	1268	Explorer.EXE	NAPSTAT.EXE
PID 1072 wrote to memory of 1664	1072	NAPSTAT.EXE	cmd.exe
PID 1072 wrote to memory of 1664	1072	NAPSTAT.EXE	cmd.exe
PID 1072 wrote to memory of 1664	1072	NAPSTAT.EXE	cmd.exe
PID 1072 wrote to memory of 1664	1072	NAPSTAT.EXE	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1268

C:\Users\Admin\AppData\Local\Temp\New Order.exe
"C:\Users\Admin\AppData\Local\Temp\New Order.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Windows\SysWOW64\NAPSTAT.EXE
"C:\Windows\SysWOW64\NAPSTAT.EXE"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
3⤵
PID:1664

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
memory/1068-11-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1068-16-0x00000000000B0000-0x00000000000C0000-memory.dmp

Filesize
64KB

Download
memory/1068-18-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/1068-15-0x0000000000A00000-0x0000000000D03000-memory.dmp

Filesize
3.0MB

Download
memory/1068-12-0x000000000041C150-mapping.dmp

Download
memory/1072-22-0x0000000000080000-0x00000000000A7000-memory.dmp

Filesize
156KB

Download
memory/1072-20-0x0000000000000000-mapping.dmp

Download
memory/1072-21-0x00000000002D0000-0x0000000000316000-memory.dmp

Filesize
280KB

Download
memory/1072-23-0x0000000002030000-0x0000000002333000-memory.dmp

Filesize
3.0MB

Download
memory/1072-26-0x00000000005A0000-0x000000000062F000-memory.dmp

Filesize
572KB

Download
memory/1268-19-0x0000000004D90000-0x0000000004EDB000-memory.dmp

Filesize
1.3MB

Download
memory/1268-17-0x0000000003C10000-0x0000000003CC3000-memory.dmp

Filesize
716KB

Download
memory/1648-2-0x0000000074000000-0x00000000746EE000-memory.dmp

Filesize
6.9MB

Download
memory/1648-9-0x0000000000750000-0x0000000000759000-memory.dmp

Filesize
36KB

Download
memory/1648-8-0x0000000004AC1000-0x0000000004AC2000-memory.dmp

Filesize
4KB

Download
memory/1648-7-0x0000000000450000-0x000000000045A000-memory.dmp

Filesize
40KB

Download
memory/1648-6-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Filesize
4KB

Download
memory/1648-5-0x00000000002D0000-0x00000000002F5000-memory.dmp

Filesize
148KB

Download
memory/1648-3-0x0000000001250000-0x0000000001251000-memory.dmp

Filesize
4KB

Download
memory/1664-25-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads