xloader | 069a900aaa6ab5e4b9279cf5bd47e7123c37787f87ac58d6e64383685371ba52

General

Target

SWIFT 00395_IMG.exe
Size

13.4MB
MD5

f19e6012ff248b9b380bb420080258ce
SHA1

317ee43a8116aae39f3de3279620ecff4ac05b2c
SHA256

069a900aaa6ab5e4b9279cf5bd47e7123c37787f87ac58d6e64383685371ba52
SHA512

ad555d5a6bbd753825fba4a4665b4774d88f4011f3c7c6a2c0084fd40e59d66d2880b4a390cc8a172e51b67f8198d0fa481a981c916025f1642ace15c5ab1cdf

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.seroungift.com/bbqo/

Decoy

theinfluenstar.com

1800quilts.com

sonsuz-muzik.com

manilowsmodems.com

amwajcare.com

eam.email

cscosmos.com

tierraovens.com

goimtv.com

checks4d.com

beijig.com

szzyhjj.com

huanchunjx.com

catqq.one

vendasuascartas.com

cannatends.com

cytotecobatpenggugur.com

centralvalleypartners4youth.com

entreforma.com

azhathai.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1908-63-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/828-73-0x0000000000080000-0x00000000000A8000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

SWIFT 00395_IMG.exe

pid process

1640 SWIFT 00395_IMG.exe

pid	process
1640	SWIFT 00395_IMG.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

SWIFT 00395_IMG.exesvchost.execolorcpl.exe

description	pid	process	target process
PID 1640 set thread context of 1908	1640	SWIFT 00395_IMG.exe	svchost.exe
PID 1908 set thread context of 1192	1908	svchost.exe	Explorer.EXE
PID 1908 set thread context of 1192	1908	svchost.exe	Explorer.EXE
PID 828 set thread context of 1192	828	colorcpl.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

svchost.execolorcpl.exe

pid	process
1908	svchost.exe
1908	svchost.exe
1908	svchost.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe
828	colorcpl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1192 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

SWIFT 00395_IMG.exesvchost.execolorcpl.exe

pid process

1640 SWIFT 00395_IMG.exe
1908 svchost.exe
1908 svchost.exe
1908 svchost.exe
1908 svchost.exe
828 colorcpl.exe
828 colorcpl.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

svchost.execolorcpl.exe

description pid process

Token: SeDebugPrivilege 1908 svchost.exe
Token: SeDebugPrivilege 828 colorcpl.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1192 Explorer.EXE
1192 Explorer.EXE
1192 Explorer.EXE
1192 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1192 Explorer.EXE
1192 Explorer.EXE
1192 Explorer.EXE
1192 Explorer.EXE

pid	process
1192	Explorer.EXE

pid	process
1640	SWIFT 00395_IMG.exe
1908	svchost.exe
1908	svchost.exe
1908	svchost.exe
1908	svchost.exe
828	colorcpl.exe
828	colorcpl.exe

description	pid	process
Token: SeDebugPrivilege	1908	svchost.exe
Token: SeDebugPrivilege	828	colorcpl.exe

pid	process
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE

pid	process
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

SWIFT 00395_IMG.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 1640 wrote to memory of 1908	1640	SWIFT 00395_IMG.exe	svchost.exe
PID 1640 wrote to memory of 1908	1640	SWIFT 00395_IMG.exe	svchost.exe
PID 1640 wrote to memory of 1908	1640	SWIFT 00395_IMG.exe	svchost.exe
PID 1640 wrote to memory of 1908	1640	SWIFT 00395_IMG.exe	svchost.exe
PID 1640 wrote to memory of 1908	1640	SWIFT 00395_IMG.exe	svchost.exe
PID 1192 wrote to memory of 828	1192	Explorer.EXE	colorcpl.exe
PID 1192 wrote to memory of 828	1192	Explorer.EXE	colorcpl.exe
PID 1192 wrote to memory of 828	1192	Explorer.EXE	colorcpl.exe
PID 1192 wrote to memory of 828	1192	Explorer.EXE	colorcpl.exe
PID 828 wrote to memory of 1540	828	colorcpl.exe	cmd.exe
PID 828 wrote to memory of 1540	828	colorcpl.exe	cmd.exe
PID 828 wrote to memory of 1540	828	colorcpl.exe	cmd.exe
PID 828 wrote to memory of 1540	828	colorcpl.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1192

C:\Users\Admin\AppData\Local\Temp\SWIFT 00395_IMG.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT 00395_IMG.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\SWIFT 00395_IMG.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1908

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\SysWOW64\svchost.exe"
3⤵
PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsx4D57.tmp\3bypcf8qb.dll
MD5
71d2d0b499c40f82a6cdd1ecdc4df303

SHA1
ae42e7a68b3affc5f56238fc46fb2faaad75b890

SHA256
0c3c61ba24bb070c77191b1134e337148ea90e9814083ffb84edf58ee497a2ef

SHA512
c64e28ca27d98e99e1132f59aa2bc8141cd49ab6ece0b9bf0539eca059eef962923a4890355482f1d22aa5902ff4ceff0da6dc3737a10a9050dda582cdbff67e

Download Submit
memory/828-72-0x00000000004B0000-0x00000000004C8000-memory.dmp

Filesize
96KB

Download
memory/828-75-0x0000000001D80000-0x0000000001E0F000-memory.dmp

Filesize
572KB

Download
memory/828-74-0x0000000001FB0000-0x00000000022B3000-memory.dmp

Filesize
3.0MB

Download
memory/828-73-0x0000000000080000-0x00000000000A8000-memory.dmp

Filesize
160KB

Download
memory/828-69-0x0000000000000000-mapping.dmp

Download
memory/1192-76-0x0000000006470000-0x00000000065FE000-memory.dmp

Filesize
1.6MB

Download
memory/1192-66-0x00000000062C0000-0x0000000006466000-memory.dmp

Filesize
1.6MB

Download
memory/1192-68-0x0000000003D10000-0x0000000003DDE000-memory.dmp

Filesize
824KB

Download
memory/1540-71-0x0000000000000000-mapping.dmp

Download
memory/1640-61-0x00000000003D0000-0x00000000003D2000-memory.dmp

Filesize
8KB

Download
memory/1640-59-0x00000000769B1000-0x00000000769B3000-memory.dmp

Filesize
8KB

Download
memory/1908-65-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1908-67-0x00000000001B0000-0x00000000001C0000-memory.dmp

Filesize
64KB

Download
memory/1908-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1908-64-0x0000000000BF0000-0x0000000000EF3000-memory.dmp

Filesize
3.0MB

Download
memory/1908-62-0x000000000041D040-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads