xloader | b32ad3bf2b79e411ca0450c1d5430d12c9bb73c269e0838ee512bc816fcce3b7

General

Target

vbc.exe
Size

775KB
MD5

74ed218c2c421e3978445a1edbe40a08
SHA1

16d950eae07654c9805d4476928c4c8d7d12fcc1
SHA256

b32ad3bf2b79e411ca0450c1d5430d12c9bb73c269e0838ee512bc816fcce3b7
SHA512

0cb4af6ad1434d4140d0e055fc77de2543c9ea9babe077de27184b1628cbdc8f32530c5f0c2f4b3e1199459c0521e67415421525070c0870e75dc09105bf94d6

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.cats16.com/8u3b/

Decoy

pipienta.com

wisdomfest.net

jenniferreich.com

bigcanoehomesforless.com

kayandbernard.com

offerbuildingsecrets.com

benleefoto.com

contactlesssoftware.tech

statenislandplumbing.info

lifestylemedicineservices.com

blazerplanning.com

fnatic-skins.club

effectivemarketinginc.com

babyshopit.com

2000deal.com

k12paymentcemter.com

spwakd.com

lesreponses.com

abundando.com

hawkspremierfhc.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/868-66-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/868-67-0x000000000041D0A0-mapping.dmp	xloader
behavioral1/memory/1564-78-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

640 cmd.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
640	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

vbc.exevbc.exe

description	pid	process	target process
PID 1996 set thread context of 868	1996	vbc.exe	vbc.exe
PID 868 set thread context of 1224	868	vbc.exe	Explorer.EXE
PID 868 set thread context of 1224	868	vbc.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

vbc.exeexplorer.exe

pid process

868 vbc.exe
868 vbc.exe
868 vbc.exe
1564 explorer.exe
1564 explorer.exe
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

vbc.exeexplorer.exe

pid process

868 vbc.exe
868 vbc.exe
868 vbc.exe
868 vbc.exe
1564 explorer.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

vbc.exeexplorer.exe

description pid process

Token: SeDebugPrivilege 868 vbc.exe
Token: SeDebugPrivilege 1564 explorer.exe

pid	process
868	vbc.exe
868	vbc.exe
868	vbc.exe
1564	explorer.exe
1564	explorer.exe

pid	process
868	vbc.exe
868	vbc.exe
868	vbc.exe
868	vbc.exe
1564	explorer.exe

description	pid	process
Token: SeDebugPrivilege	868	vbc.exe
Token: SeDebugPrivilege	1564	explorer.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

vbc.exevbc.exeexplorer.exe

description	pid	process	target process
PID 1996 wrote to memory of 868	1996	vbc.exe	vbc.exe
PID 1996 wrote to memory of 868	1996	vbc.exe	vbc.exe
PID 1996 wrote to memory of 868	1996	vbc.exe	vbc.exe
PID 1996 wrote to memory of 868	1996	vbc.exe	vbc.exe
PID 1996 wrote to memory of 868	1996	vbc.exe	vbc.exe
PID 1996 wrote to memory of 868	1996	vbc.exe	vbc.exe
PID 1996 wrote to memory of 868	1996	vbc.exe	vbc.exe
PID 868 wrote to memory of 1564	868	vbc.exe	explorer.exe
PID 868 wrote to memory of 1564	868	vbc.exe	explorer.exe
PID 868 wrote to memory of 1564	868	vbc.exe	explorer.exe
PID 868 wrote to memory of 1564	868	vbc.exe	explorer.exe
PID 1564 wrote to memory of 640	1564	explorer.exe	cmd.exe
PID 1564 wrote to memory of 640	1564	explorer.exe	cmd.exe
PID 1564 wrote to memory of 640	1564	explorer.exe	cmd.exe
PID 1564 wrote to memory of 640	1564	explorer.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1224

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"
5⤵
- Deletes itself
PID:640

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:1660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-80-0x0000000000000000-mapping.dmp

Download
memory/868-72-0x00000000001D0000-0x00000000001E1000-memory.dmp

Filesize
68KB

Download
memory/868-71-0x00000000008F0000-0x0000000000BF3000-memory.dmp

Filesize
3.0MB

Download
memory/868-66-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/868-67-0x000000000041D0A0-mapping.dmp

Download
memory/868-69-0x0000000000190000-0x00000000001A1000-memory.dmp

Filesize
68KB

Download
memory/1224-70-0x0000000005FE0000-0x0000000006185000-memory.dmp

Filesize
1.6MB

Download
memory/1224-73-0x0000000002AB0000-0x0000000002B76000-memory.dmp

Filesize
792KB

Download
memory/1564-74-0x0000000000000000-mapping.dmp

Download
memory/1564-75-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/1564-76-0x0000000074FA1000-0x0000000074FA3000-memory.dmp

Filesize
8KB

Download
memory/1564-78-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/1564-79-0x0000000002260000-0x0000000002563000-memory.dmp

Filesize
3.0MB

Download
memory/1564-77-0x0000000000BD0000-0x0000000000E51000-memory.dmp

Filesize
2.5MB

Download
memory/1996-65-0x0000000005100000-0x0000000005162000-memory.dmp

Filesize
392KB

Download
memory/1996-64-0x0000000005050000-0x00000000050F8000-memory.dmp

Filesize
672KB

Download
memory/1996-63-0x0000000000600000-0x000000000060E000-memory.dmp

Filesize
56KB

Download
memory/1996-60-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1996-62-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads