xloader | 2138325dd5e2825ee4086187a944af336476b0327e1ddae7563bb24523836e08

Analysis

max time kernel
150s
max time network
146s
platform
windows10_x64
resource
win10v20210408
submitted
03-05-2021 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HAWB AND INV.exe
Size

724KB
MD5

42662765a94ce5ece11529509f937711
SHA1

da57dd4c137c47fc9b906caaf067c6ed13fa2da6
SHA256

2138325dd5e2825ee4086187a944af336476b0327e1ddae7563bb24523836e08
SHA512

101d7bb5f778e779133f005c801fa26cf1bc147fed9f2774808526c50b3ae8e12863bc7ee3dfb060153d4b0b3a5ef66f357e44d477e1558060fe54df990b4b95

Score

10^/10

xloader evasion loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

http://www.alldaazz.com/maw9/

Decoy

jaimericart.com

mayavantcard.com

romanzava.site

forefrontunderground.com

grafikirmarketing.com

airpoppoff.com

captureq.com

vph.ventures

historiclocation.com

theoxfordway.com

springersells.com

huther.mobi

networkingmaderas.com

reggatech.com

dollfacela.com

moneycrypt.net

calidad-precio.net

hamnsk165.com

victoriabrownrealtor.com

itechfreak.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1536-151-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/1536-152-0x000000000041D0B0-mapping.dmp	xloader
behavioral2/memory/1180-190-0x0000000002F10000-0x0000000002F39000-memory.dmp	xloader

Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

HAWB AND INV.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	HAWB AND INV.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	HAWB AND INV.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

HAWB AND INV.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	HAWB AND INV.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	HAWB AND INV.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

HAWB AND INV.exeHAWB AND INV.exemsdt.exe

description	pid	process	target process
PID 424 set thread context of 1536	424	HAWB AND INV.exe	HAWB AND INV.exe
PID 1536 set thread context of 2180	1536	HAWB AND INV.exe	Explorer.EXE
PID 1180 set thread context of 2180	1180	msdt.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2548 schtasks.exe

pid	process
2548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

powershell.exepowershell.exepowershell.exeHAWB AND INV.exemsdt.exe

pid	process
1548	powershell.exe
2884	powershell.exe
3600	powershell.exe
1536	HAWB AND INV.exe
1536	HAWB AND INV.exe
1548	powershell.exe
2884	powershell.exe
1536	HAWB AND INV.exe
1536	HAWB AND INV.exe
3600	powershell.exe
3600	powershell.exe
2884	powershell.exe
1548	powershell.exe
1180	msdt.exe
1180	msdt.exe
1180	msdt.exe
1180	msdt.exe
1180	msdt.exe
1180	msdt.exe
1180	msdt.exe
1180	msdt.exe
1180	msdt.exe
1180	msdt.exe
1180	msdt.exe
1180	msdt.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

HAWB AND INV.exemsdt.exe

pid process

1536 HAWB AND INV.exe
1536 HAWB AND INV.exe
1536 HAWB AND INV.exe
1180 msdt.exe
1180 msdt.exe

pid	process
1536	HAWB AND INV.exe
1536	HAWB AND INV.exe
1536	HAWB AND INV.exe
1180	msdt.exe
1180	msdt.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

powershell.exepowershell.exepowershell.exeHAWB AND INV.exemsdt.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeDebugPrivilege	1536	HAWB AND INV.exe
Token: SeDebugPrivilege	1180	msdt.exe
Token: SeShutdownPrivilege	2180	Explorer.EXE
Token: SeCreatePagefilePrivilege	2180	Explorer.EXE
Token: SeShutdownPrivilege	2180	Explorer.EXE
Token: SeCreatePagefilePrivilege	2180	Explorer.EXE
Token: SeShutdownPrivilege	2180	Explorer.EXE
Token: SeCreatePagefilePrivilege	2180	Explorer.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

HAWB AND INV.exeExplorer.EXE

description	pid	process	target process
PID 424 wrote to memory of 1548	424	HAWB AND INV.exe	powershell.exe
PID 424 wrote to memory of 1548	424	HAWB AND INV.exe	powershell.exe
PID 424 wrote to memory of 1548	424	HAWB AND INV.exe	powershell.exe
PID 424 wrote to memory of 2884	424	HAWB AND INV.exe	powershell.exe
PID 424 wrote to memory of 2884	424	HAWB AND INV.exe	powershell.exe
PID 424 wrote to memory of 2884	424	HAWB AND INV.exe	powershell.exe
PID 424 wrote to memory of 2548	424	HAWB AND INV.exe	schtasks.exe
PID 424 wrote to memory of 2548	424	HAWB AND INV.exe	schtasks.exe
PID 424 wrote to memory of 2548	424	HAWB AND INV.exe	schtasks.exe
PID 424 wrote to memory of 3600	424	HAWB AND INV.exe	powershell.exe
PID 424 wrote to memory of 3600	424	HAWB AND INV.exe	powershell.exe
PID 424 wrote to memory of 3600	424	HAWB AND INV.exe	powershell.exe
PID 424 wrote to memory of 1536	424	HAWB AND INV.exe	HAWB AND INV.exe
PID 424 wrote to memory of 1536	424	HAWB AND INV.exe	HAWB AND INV.exe
PID 424 wrote to memory of 1536	424	HAWB AND INV.exe	HAWB AND INV.exe
PID 424 wrote to memory of 1536	424	HAWB AND INV.exe	HAWB AND INV.exe
PID 424 wrote to memory of 1536	424	HAWB AND INV.exe	HAWB AND INV.exe
PID 424 wrote to memory of 1536	424	HAWB AND INV.exe	HAWB AND INV.exe
PID 2180 wrote to memory of 1180	2180	Explorer.EXE	msdt.exe
PID 2180 wrote to memory of 1180	2180	Explorer.EXE	msdt.exe
PID 2180 wrote to memory of 1180	2180	Explorer.EXE	msdt.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180

C:\Users\Admin\AppData\Local\Temp\HAWB AND INV.exe
"C:\Users\Admin\AppData\Local\Temp\HAWB AND INV.exe"
2⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:424

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\HAWB AND INV.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qxnptkmQbHB.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qxnptkmQbHB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp21F.tmp"
3⤵
- Creates scheduled task(s)
PID:2548

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qxnptkmQbHB.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Users\Admin\AppData\Local\Temp\HAWB AND INV.exe
"C:\Users\Admin\AppData\Local\Temp\HAWB AND INV.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Windows\SysWOW64\msdt.exe
"C:\Windows\SysWOW64\msdt.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5
db01a2c1c7e70b2b038edf8ad5ad9826

SHA1
540217c647a73bad8d8a79e3a0f3998b5abd199b

SHA256
413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

SHA512
c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
e3fd269a32ffa9ae351930f3f8242fe9

SHA1
834c11fe02e8a4148e3782df663de4d5222931f8

SHA256
6c645cd7163a91d96a9f8e06f3af40c2ce37af47e28a02a720b4b87a335f4275

SHA512
658ac9ef8e4e1cccd1531655bc6fe9ca7164ce80af84764d1009efb68db0e77601e8e4a6115c0a9c550729adb5cc588ae35a8197efaf095f9371a63f3f9f5049

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp21F.tmp

MD5
997eee7f1fe87bc0fa36551f7d041a1b

SHA1
fc5a7677c7aff364cf7559b7fcad46718cf0439d

SHA256
cb350af5c1c55cbccc7249f1b9fcba66ce979f9d6a4793bd4caa094c7a87cd66

SHA512
a3bc8b8eee2e7a3bcff4a3da6a88c0badc886541ac0727904b62b8691839a537bc2ac3b667bf6882b76f513ee1554c260e304a9235068cf2924165958da2ca7a

Download Submit
memory/424-121-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Filesize
4KB

Download
memory/424-119-0x0000000000B80000-0x0000000000B81000-memory.dmp

Filesize
4KB

Download
memory/424-120-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/424-118-0x0000000004A70000-0x0000000004A71000-memory.dmp

Filesize
4KB

Download
memory/424-122-0x0000000004D00000-0x0000000004D0E000-memory.dmp

Filesize
56KB

Download
memory/424-123-0x0000000005730000-0x00000000057D7000-memory.dmp

Filesize
668KB

Download
memory/424-124-0x0000000007C90000-0x0000000007CF0000-memory.dmp

Filesize
384KB

Download
memory/424-117-0x0000000004F70000-0x0000000004F71000-memory.dmp

Filesize
4KB

Download
memory/424-126-0x000000000AD60000-0x000000000AD61000-memory.dmp

Filesize
4KB

Download
memory/424-114-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/424-116-0x00000000049D0000-0x00000000049D1000-memory.dmp

Filesize
4KB

Download
memory/1180-207-0x0000000004A70000-0x0000000004AFF000-memory.dmp

Filesize
572KB

Download
memory/1180-195-0x00000000046C0000-0x00000000049E0000-memory.dmp

Filesize
3.1MB

Download
memory/1180-190-0x0000000002F10000-0x0000000002F39000-memory.dmp

Filesize
164KB

Download
memory/1180-189-0x00000000000D0000-0x0000000000243000-memory.dmp

Filesize
1.4MB

Download
memory/1180-182-0x0000000000000000-mapping.dmp

Download
memory/1536-165-0x0000000000C00000-0x0000000000CAE000-memory.dmp

Filesize
696KB

Download
memory/1536-151-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1536-164-0x00000000011B0000-0x00000000014D0000-memory.dmp

Filesize
3.1MB

Download
memory/1536-152-0x000000000041D0B0-mapping.dmp

Download
memory/1548-129-0x0000000004110000-0x0000000004111000-memory.dmp

Filesize
4KB

Download
memory/1548-173-0x0000000007C60000-0x0000000007C61000-memory.dmp

Filesize
4KB

Download
memory/1548-125-0x0000000000000000-mapping.dmp

Download
memory/1548-130-0x0000000006C10000-0x0000000006C11000-memory.dmp

Filesize
4KB

Download
memory/1548-131-0x00000000041F0000-0x00000000041F1000-memory.dmp

Filesize
4KB

Download
memory/1548-204-0x00000000041F3000-0x00000000041F4000-memory.dmp

Filesize
4KB

Download
memory/1548-139-0x0000000006AE0000-0x0000000006AE1000-memory.dmp

Filesize
4KB

Download
memory/1548-199-0x000000007EF40000-0x000000007EF41000-memory.dmp

Filesize
4KB

Download
memory/1548-132-0x00000000041F2000-0x00000000041F3000-memory.dmp

Filesize
4KB

Download
memory/1548-134-0x0000000006940000-0x0000000006941000-memory.dmp

Filesize
4KB

Download
memory/1548-170-0x0000000007920000-0x0000000007921000-memory.dmp

Filesize
4KB

Download
memory/2180-166-0x00000000064B0000-0x00000000065E9000-memory.dmp

Filesize
1.2MB

Download
memory/2180-208-0x00000000030F0000-0x00000000031A7000-memory.dmp

Filesize
732KB

Download
memory/2548-138-0x0000000000000000-mapping.dmp

Download
memory/2884-146-0x0000000007410000-0x0000000007411000-memory.dmp

Filesize
4KB

Download
memory/2884-167-0x0000000007760000-0x0000000007761000-memory.dmp

Filesize
4KB

Download
memory/2884-133-0x0000000000000000-mapping.dmp

Download
memory/2884-200-0x000000007E730000-0x000000007E731000-memory.dmp

Filesize
4KB

Download
memory/2884-149-0x00000000066C2000-0x00000000066C3000-memory.dmp

Filesize
4KB

Download
memory/2884-202-0x00000000066C3000-0x00000000066C4000-memory.dmp

Filesize
4KB

Download
memory/2884-148-0x00000000066C0000-0x00000000066C1000-memory.dmp

Filesize
4KB

Download
memory/3600-162-0x0000000006EC0000-0x0000000006EC1000-memory.dmp

Filesize
4KB

Download
memory/3600-163-0x0000000006EC2000-0x0000000006EC3000-memory.dmp

Filesize
4KB

Download
memory/3600-203-0x0000000006EC3000-0x0000000006EC4000-memory.dmp

Filesize
4KB

Download
memory/3600-201-0x000000007E840000-0x000000007E841000-memory.dmp

Filesize
4KB

Download
memory/3600-150-0x0000000000000000-mapping.dmp

Download