xloader | 2138325dd5e2825ee4086187a944af336476b0327e1ddae7563bb24523836e08

General

Target

HAWB AND INV.exe
Size

724KB
MD5

42662765a94ce5ece11529509f937711
SHA1

da57dd4c137c47fc9b906caaf067c6ed13fa2da6
SHA256

2138325dd5e2825ee4086187a944af336476b0327e1ddae7563bb24523836e08
SHA512

101d7bb5f778e779133f005c801fa26cf1bc147fed9f2774808526c50b3ae8e12863bc7ee3dfb060153d4b0b3a5ef66f357e44d477e1558060fe54df990b4b95

Score

10^/10

xloader evasion loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.alldaazz.com/maw9/

Decoy

jaimericart.com

mayavantcard.com

romanzava.site

forefrontunderground.com

grafikirmarketing.com

airpoppoff.com

captureq.com

vph.ventures

historiclocation.com

theoxfordway.com

springersells.com

huther.mobi

networkingmaderas.com

reggatech.com

dollfacela.com

moneycrypt.net

calidad-precio.net

hamnsk165.com

victoriabrownrealtor.com

itechfreak.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/508-151-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/508-152-0x000000000041D0B0-mapping.dmp	xloader
behavioral2/memory/3288-200-0x00000000030C0000-0x00000000030E9000-memory.dmp	xloader

Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

HAWB AND INV.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	HAWB AND INV.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	HAWB AND INV.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

HAWB AND INV.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	HAWB AND INV.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	HAWB AND INV.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

HAWB AND INV.exeHAWB AND INV.exemstsc.exe

description	pid	process	target process
PID 796 set thread context of 508	796	HAWB AND INV.exe	HAWB AND INV.exe
PID 508 set thread context of 3024	508	HAWB AND INV.exe	Explorer.EXE
PID 3288 set thread context of 3024	3288	mstsc.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3232 schtasks.exe

pid	process
3232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

powershell.exepowershell.exeHAWB AND INV.exepowershell.exemstsc.exe

pid	process
2696	powershell.exe
3832	powershell.exe
3832	powershell.exe
2696	powershell.exe
508	HAWB AND INV.exe
508	HAWB AND INV.exe
508	HAWB AND INV.exe
508	HAWB AND INV.exe
204	powershell.exe
204	powershell.exe
2696	powershell.exe
3832	powershell.exe
204	powershell.exe
3288	mstsc.exe
3288	mstsc.exe
3288	mstsc.exe
3288	mstsc.exe
3288	mstsc.exe
3288	mstsc.exe
3288	mstsc.exe
3288	mstsc.exe
3288	mstsc.exe
3288	mstsc.exe
3288	mstsc.exe
3288	mstsc.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

HAWB AND INV.exemstsc.exe

pid process

508 HAWB AND INV.exe
508 HAWB AND INV.exe
508 HAWB AND INV.exe
3288 mstsc.exe
3288 mstsc.exe

pid	process
508	HAWB AND INV.exe
508	HAWB AND INV.exe
508	HAWB AND INV.exe
3288	mstsc.exe
3288	mstsc.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

powershell.exepowershell.exeHAWB AND INV.exepowershell.exemstsc.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	3832	powershell.exe
Token: SeDebugPrivilege	508	HAWB AND INV.exe
Token: SeDebugPrivilege	204	powershell.exe
Token: SeDebugPrivilege	3288	mstsc.exe
Token: SeShutdownPrivilege	3024	Explorer.EXE
Token: SeCreatePagefilePrivilege	3024	Explorer.EXE
Token: SeShutdownPrivilege	3024	Explorer.EXE
Token: SeCreatePagefilePrivilege	3024	Explorer.EXE
Token: SeShutdownPrivilege	3024	Explorer.EXE
Token: SeCreatePagefilePrivilege	3024	Explorer.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

HAWB AND INV.exeExplorer.EXE

description	pid	process	target process
PID 796 wrote to memory of 2696	796	HAWB AND INV.exe	powershell.exe
PID 796 wrote to memory of 2696	796	HAWB AND INV.exe	powershell.exe
PID 796 wrote to memory of 2696	796	HAWB AND INV.exe	powershell.exe
PID 796 wrote to memory of 3832	796	HAWB AND INV.exe	powershell.exe
PID 796 wrote to memory of 3832	796	HAWB AND INV.exe	powershell.exe
PID 796 wrote to memory of 3832	796	HAWB AND INV.exe	powershell.exe
PID 796 wrote to memory of 3232	796	HAWB AND INV.exe	schtasks.exe
PID 796 wrote to memory of 3232	796	HAWB AND INV.exe	schtasks.exe
PID 796 wrote to memory of 3232	796	HAWB AND INV.exe	schtasks.exe
PID 796 wrote to memory of 204	796	HAWB AND INV.exe	powershell.exe
PID 796 wrote to memory of 204	796	HAWB AND INV.exe	powershell.exe
PID 796 wrote to memory of 204	796	HAWB AND INV.exe	powershell.exe
PID 796 wrote to memory of 508	796	HAWB AND INV.exe	HAWB AND INV.exe
PID 796 wrote to memory of 508	796	HAWB AND INV.exe	HAWB AND INV.exe
PID 796 wrote to memory of 508	796	HAWB AND INV.exe	HAWB AND INV.exe
PID 796 wrote to memory of 508	796	HAWB AND INV.exe	HAWB AND INV.exe
PID 796 wrote to memory of 508	796	HAWB AND INV.exe	HAWB AND INV.exe
PID 796 wrote to memory of 508	796	HAWB AND INV.exe	HAWB AND INV.exe
PID 3024 wrote to memory of 3288	3024	Explorer.EXE	mstsc.exe
PID 3024 wrote to memory of 3288	3024	Explorer.EXE	mstsc.exe
PID 3024 wrote to memory of 3288	3024	Explorer.EXE	mstsc.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024

C:\Users\Admin\AppData\Local\Temp\HAWB AND INV.exe
"C:\Users\Admin\AppData\Local\Temp\HAWB AND INV.exe"
2⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\HAWB AND INV.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qxnptkmQbHB.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3832

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qxnptkmQbHB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp45CF.tmp"
3⤵
- Creates scheduled task(s)
PID:3232

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qxnptkmQbHB.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:204

C:\Users\Admin\AppData\Local\Temp\HAWB AND INV.exe
"C:\Users\Admin\AppData\Local\Temp\HAWB AND INV.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:508

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3288

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
db01a2c1c7e70b2b038edf8ad5ad9826

SHA1
540217c647a73bad8d8a79e3a0f3998b5abd199b

SHA256
413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

SHA512
c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
df409bc19e0ddf081ffcca3240e42443

SHA1
b82fc074275af541cb0c2afdbd2b4662a04ae7eb

SHA256
5f4171b463974e756abec79f0afd72d195f7fffa23460f633959f028efc8aaf2

SHA512
baed7c4a7396d45ecbad01a4b0411882e37120748345c5f78a26507d633669448038e6fe02ee552ef08099c4e5afe788e464c9c24e9840dd4b4776ba01bdd2e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
df409bc19e0ddf081ffcca3240e42443

SHA1
b82fc074275af541cb0c2afdbd2b4662a04ae7eb

SHA256
5f4171b463974e756abec79f0afd72d195f7fffa23460f633959f028efc8aaf2

SHA512
baed7c4a7396d45ecbad01a4b0411882e37120748345c5f78a26507d633669448038e6fe02ee552ef08099c4e5afe788e464c9c24e9840dd4b4776ba01bdd2e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp45CF.tmp
MD5
997eee7f1fe87bc0fa36551f7d041a1b

SHA1
fc5a7677c7aff364cf7559b7fcad46718cf0439d

SHA256
cb350af5c1c55cbccc7249f1b9fcba66ce979f9d6a4793bd4caa094c7a87cd66

SHA512
a3bc8b8eee2e7a3bcff4a3da6a88c0badc886541ac0727904b62b8691839a537bc2ac3b667bf6882b76f513ee1554c260e304a9235068cf2924165958da2ca7a

Download Submit
memory/204-198-0x000000007F0F0000-0x000000007F0F1000-memory.dmp

Filesize
4KB

Download
memory/204-150-0x0000000000000000-mapping.dmp

Download
memory/204-164-0x0000000006E72000-0x0000000006E73000-memory.dmp

Filesize
4KB

Download
memory/204-162-0x0000000006E70000-0x0000000006E71000-memory.dmp

Filesize
4KB

Download
memory/204-204-0x0000000006E73000-0x0000000006E74000-memory.dmp

Filesize
4KB

Download
memory/508-163-0x00000000012E0000-0x0000000001600000-memory.dmp

Filesize
3.1MB

Download
memory/508-173-0x0000000000D50000-0x0000000000E9A000-memory.dmp

Filesize
1.3MB

Download
memory/508-152-0x000000000041D0B0-mapping.dmp

Download
memory/508-151-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/796-121-0x0000000005180000-0x000000000521C000-memory.dmp

Filesize
624KB

Download
memory/796-114-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/796-126-0x000000000B570000-0x000000000B571000-memory.dmp

Filesize
4KB

Download
memory/796-124-0x00000000010D0000-0x0000000001130000-memory.dmp

Filesize
384KB

Download
memory/796-123-0x0000000002AA0000-0x0000000002B47000-memory.dmp

Filesize
668KB

Download
memory/796-122-0x0000000005770000-0x000000000577E000-memory.dmp

Filesize
56KB

Download
memory/796-120-0x0000000005500000-0x0000000005501000-memory.dmp

Filesize
4KB

Download
memory/796-119-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/796-118-0x00000000052D0000-0x00000000052D1000-memory.dmp

Filesize
4KB

Download
memory/796-117-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/796-116-0x0000000005220000-0x0000000005221000-memory.dmp

Filesize
4KB

Download
memory/2696-129-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download
memory/2696-197-0x000000007ECC0000-0x000000007ECC1000-memory.dmp

Filesize
4KB

Download
memory/2696-125-0x0000000000000000-mapping.dmp

Download
memory/2696-155-0x00000000083D0000-0x00000000083D1000-memory.dmp

Filesize
4KB

Download
memory/2696-130-0x0000000007AE0000-0x0000000007AE1000-memory.dmp

Filesize
4KB

Download
memory/2696-132-0x00000000050F2000-0x00000000050F3000-memory.dmp

Filesize
4KB

Download
memory/2696-140-0x0000000008360000-0x0000000008361000-memory.dmp

Filesize
4KB

Download
memory/2696-138-0x0000000007AA0000-0x0000000007AA1000-memory.dmp

Filesize
4KB

Download
memory/2696-165-0x0000000008B60000-0x0000000008B61000-memory.dmp

Filesize
4KB

Download
memory/2696-131-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/2696-201-0x00000000050F3000-0x00000000050F4000-memory.dmp

Filesize
4KB

Download
memory/2696-146-0x0000000008490000-0x0000000008491000-memory.dmp

Filesize
4KB

Download
memory/3024-174-0x0000000002610000-0x00000000026DC000-memory.dmp

Filesize
816KB

Download
memory/3024-206-0x0000000004DA0000-0x0000000004E9B000-memory.dmp

Filesize
1004KB

Download
memory/3232-134-0x0000000000000000-mapping.dmp

Download
memory/3288-202-0x0000000004670000-0x0000000004990000-memory.dmp

Filesize
3.1MB

Download
memory/3288-200-0x00000000030C0000-0x00000000030E9000-memory.dmp

Filesize
164KB

Download
memory/3288-199-0x0000000000AC0000-0x0000000000DBC000-memory.dmp

Filesize
3.0MB

Download
memory/3288-205-0x0000000004A20000-0x0000000004AAF000-memory.dmp

Filesize
572KB

Download
memory/3288-186-0x0000000000000000-mapping.dmp

Download
memory/3832-196-0x000000007F4A0000-0x000000007F4A1000-memory.dmp

Filesize
4KB

Download
memory/3832-203-0x00000000073A3000-0x00000000073A4000-memory.dmp

Filesize
4KB

Download
memory/3832-133-0x0000000000000000-mapping.dmp

Download
memory/3832-141-0x00000000073A0000-0x00000000073A1000-memory.dmp

Filesize
4KB

Download
memory/3832-158-0x00000000086B0000-0x00000000086B1000-memory.dmp

Filesize
4KB

Download
memory/3832-142-0x00000000073A2000-0x00000000073A3000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads