xloader | 173797a7a7a881f3d6230015620bae28d21b4b41b7e568c2a881b3c0829dd67e

General

Target

08917506_by_Libranalysis.exe
Size

671KB
MD5

089175069d5c095f078b7f8a3b28a22d
SHA1

a563615dfe562e7a11c2b7f21dcfcd412594eeee
SHA256

173797a7a7a881f3d6230015620bae28d21b4b41b7e568c2a881b3c0829dd67e
SHA512

987900b187a7757e186238fcc1a6b72c26a8b6619818ea34d91df86c8f1a1f79e31323d42f054f98cb705ec9c6b4720c5159f5746739388fa971942db79b5694

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.evrbrite.com/o86d/

Decoy

marielivet.com

shadowlovely.com

novfarm.com

genialnetero.com

nj-yanhua.com

thaihuay88.com

iizponja.com

stark-stg.net

nueforma.com

fincheckxu.com

joycasino-2020.club

9thwrld.com

komofood.com

weekendcost.com

marczeimet.com

santequebec.info

arpinaindustriesllc.com

soyakmuzayede.com

trivesse.online

shonanwakukengyou.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/988-69-0x000000000041CFB0-mapping.dmp	xloader
behavioral1/memory/988-68-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/320-77-0x0000000000080000-0x00000000000A8000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

664 cmd.exe

pid	process
664	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

08917506_by_Libranalysis.exe08917506_by_Libranalysis.exechkdsk.exe

description	pid	process	target process
PID 1756 set thread context of 988	1756	08917506_by_Libranalysis.exe	08917506_by_Libranalysis.exe
PID 988 set thread context of 1228	988	08917506_by_Libranalysis.exe	Explorer.EXE
PID 320 set thread context of 1228	320	chkdsk.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1692 schtasks.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

chkdsk.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe

pid	process
1692	schtasks.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

08917506_by_Libranalysis.exe08917506_by_Libranalysis.exechkdsk.exe

pid	process
1756	08917506_by_Libranalysis.exe
988	08917506_by_Libranalysis.exe
988	08917506_by_Libranalysis.exe
320	chkdsk.exe
320	chkdsk.exe
320	chkdsk.exe
320	chkdsk.exe
320	chkdsk.exe
320	chkdsk.exe
320	chkdsk.exe
320	chkdsk.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

08917506_by_Libranalysis.exechkdsk.exe

pid process

988 08917506_by_Libranalysis.exe
988 08917506_by_Libranalysis.exe
988 08917506_by_Libranalysis.exe
320 chkdsk.exe
320 chkdsk.exe

pid	process
988	08917506_by_Libranalysis.exe
988	08917506_by_Libranalysis.exe
988	08917506_by_Libranalysis.exe
320	chkdsk.exe
320	chkdsk.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

08917506_by_Libranalysis.exe08917506_by_Libranalysis.exechkdsk.exe

description	pid	process
Token: SeDebugPrivilege	1756	08917506_by_Libranalysis.exe
Token: SeDebugPrivilege	988	08917506_by_Libranalysis.exe
Token: SeDebugPrivilege	320	chkdsk.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

08917506_by_Libranalysis.exe

pid process

1756 08917506_by_Libranalysis.exe
1756 08917506_by_Libranalysis.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

08917506_by_Libranalysis.exeExplorer.EXEchkdsk.exe

description	pid	process	target process
PID 1756 wrote to memory of 1692	1756	08917506_by_Libranalysis.exe	schtasks.exe
PID 1756 wrote to memory of 1692	1756	08917506_by_Libranalysis.exe	schtasks.exe
PID 1756 wrote to memory of 1692	1756	08917506_by_Libranalysis.exe	schtasks.exe
PID 1756 wrote to memory of 1692	1756	08917506_by_Libranalysis.exe	schtasks.exe
PID 1756 wrote to memory of 988	1756	08917506_by_Libranalysis.exe	08917506_by_Libranalysis.exe
PID 1756 wrote to memory of 988	1756	08917506_by_Libranalysis.exe	08917506_by_Libranalysis.exe
PID 1756 wrote to memory of 988	1756	08917506_by_Libranalysis.exe	08917506_by_Libranalysis.exe
PID 1756 wrote to memory of 988	1756	08917506_by_Libranalysis.exe	08917506_by_Libranalysis.exe
PID 1756 wrote to memory of 988	1756	08917506_by_Libranalysis.exe	08917506_by_Libranalysis.exe
PID 1756 wrote to memory of 988	1756	08917506_by_Libranalysis.exe	08917506_by_Libranalysis.exe
PID 1756 wrote to memory of 988	1756	08917506_by_Libranalysis.exe	08917506_by_Libranalysis.exe
PID 1228 wrote to memory of 320	1228	Explorer.EXE	chkdsk.exe
PID 1228 wrote to memory of 320	1228	Explorer.EXE	chkdsk.exe
PID 1228 wrote to memory of 320	1228	Explorer.EXE	chkdsk.exe
PID 1228 wrote to memory of 320	1228	Explorer.EXE	chkdsk.exe
PID 320 wrote to memory of 664	320	chkdsk.exe	cmd.exe
PID 320 wrote to memory of 664	320	chkdsk.exe	cmd.exe
PID 320 wrote to memory of 664	320	chkdsk.exe	cmd.exe
PID 320 wrote to memory of 664	320	chkdsk.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1228

C:\Users\Admin\AppData\Local\Temp\08917506_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\08917506_by_Libranalysis.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OfCxSfBf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBC0F.tmp"
3⤵
- Creates scheduled task(s)
PID:1692

C:\Users\Admin\AppData\Local\Temp\08917506_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\08917506_by_Libranalysis.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Windows\SysWOW64\chkdsk.exe
"C:\Windows\SysWOW64\chkdsk.exe"
2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\08917506_by_Libranalysis.exe"
3⤵
- Deletes itself
PID:664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpBC0F.tmp
MD5
5bcf1ef4cbb06781ce82ad7bd5d1320c

SHA1
cbff27b102586df97379e45eb5e9011db431528d

SHA256
8ba462de3aab78fae3f7e82285685f6632ba6027d190572c628aa4edbb9fc79a

SHA512
9089f9e1b640eefba614311d4de4ee727a4ebcd9a2506604ecee86e4bfb4e65f9304ca010d03205dd4ca678bee5938fb43256e389f7f0bf2510ea1dc8175b9e5

Download Submit
memory/320-79-0x0000000000A60000-0x0000000000AEF000-memory.dmp

Filesize
572KB

Download
memory/320-78-0x0000000002140000-0x0000000002443000-memory.dmp

Filesize
3.0MB

Download
memory/320-77-0x0000000000080000-0x00000000000A8000-memory.dmp

Filesize
160KB

Download
memory/320-76-0x0000000000D30000-0x0000000000D37000-memory.dmp

Filesize
28KB

Download
memory/320-74-0x0000000000000000-mapping.dmp

Download
memory/664-75-0x0000000000000000-mapping.dmp

Download
memory/988-71-0x0000000000960000-0x0000000000C63000-memory.dmp

Filesize
3.0MB

Download
memory/988-69-0x000000000041CFB0-mapping.dmp

Download
memory/988-68-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/988-72-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/1228-73-0x0000000004D00000-0x0000000004E10000-memory.dmp

Filesize
1.1MB

Download
memory/1228-80-0x0000000004190000-0x0000000004259000-memory.dmp

Filesize
804KB

Download
memory/1692-66-0x0000000000000000-mapping.dmp

Download
memory/1756-60-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1756-65-0x0000000001F59000-0x0000000001F6A000-memory.dmp

Filesize
68KB

Download
memory/1756-64-0x0000000001F54000-0x0000000001F55000-memory.dmp

Filesize
4KB

Download
memory/1756-62-0x0000000001F51000-0x0000000001F52000-memory.dmp

Filesize
4KB

Download
memory/1756-63-0x0000000001F52000-0x0000000001F53000-memory.dmp

Filesize
4KB

Download
memory/1756-61-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads