xloader | feff12adf312ac89d4e5625650514d1fd28cb6ba417e3e27c45e4b1c5548cd68

General

Target

New order.exe
Size

205KB
MD5

c30480523e2f0d910f78aea742cb9c3a
SHA1

1edfdb02b75931f824ee82640283671be10398b4
SHA256

2eb57ff3dfafc142e693dd878044f38cb02090cbef35246b2525d19abf0fbaf5
SHA512

ad5289ced6ec2757af225d7830cab9684ee6e2a00a2088626d29b1d100920fde69062932d351d9d4a946ca269f4ba89800ad2ba02c198940204f94584c63b94d

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.onyxcomputing.com/u8nw/

Decoy

constructionjadams.com

organicwellnessfarm.com

beautiful.tours

medvows.com

foxparanormal.com

fsmxmc.com

graniterealestategroup.net

qgi1.com

astrologicsolutions.com

rafbar.com

bastiontools.net

emotist.com

stacyleets.com

bloodtypealpha.com

healtybenenfitsplus.com

vavadadoa3.com

chefbenhk.com

dotgz.com

xn--z4qm188e645c.com

ethyi.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3904-117-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/2872-123-0x0000000002820000-0x0000000002849000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

New order.exe

pid process

796 New order.exe

pid	process
796	New order.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

New order.exeNew order.execmmon32.exe

description	pid	process	target process
PID 796 set thread context of 3904	796	New order.exe	New order.exe
PID 3904 set thread context of 3024	3904	New order.exe	Explorer.EXE
PID 2872 set thread context of 3024	2872	cmmon32.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

New order.execmmon32.exe

pid	process
3904	New order.exe
3904	New order.exe
3904	New order.exe
3904	New order.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe
2872	cmmon32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3024 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

New order.exeNew order.execmmon32.exe

pid process

796 New order.exe
3904 New order.exe
3904 New order.exe
3904 New order.exe
2872 cmmon32.exe
2872 cmmon32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

New order.execmmon32.exe

description pid process

Token: SeDebugPrivilege 3904 New order.exe
Token: SeDebugPrivilege 2872 cmmon32.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3024 Explorer.EXE

pid	process
3024	Explorer.EXE

pid	process
796	New order.exe
3904	New order.exe
3904	New order.exe
3904	New order.exe
2872	cmmon32.exe
2872	cmmon32.exe

description	pid	process
Token: SeDebugPrivilege	3904	New order.exe
Token: SeDebugPrivilege	2872	cmmon32.exe

pid	process
3024	Explorer.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

New order.exeExplorer.EXEcmmon32.exe

description	pid	process	target process
PID 796 wrote to memory of 3904	796	New order.exe	New order.exe
PID 796 wrote to memory of 3904	796	New order.exe	New order.exe
PID 796 wrote to memory of 3904	796	New order.exe	New order.exe
PID 796 wrote to memory of 3904	796	New order.exe	New order.exe
PID 3024 wrote to memory of 2872	3024	Explorer.EXE	cmmon32.exe
PID 3024 wrote to memory of 2872	3024	Explorer.EXE	cmmon32.exe
PID 3024 wrote to memory of 2872	3024	Explorer.EXE	cmmon32.exe
PID 2872 wrote to memory of 1452	2872	cmmon32.exe	cmd.exe
PID 2872 wrote to memory of 1452	2872	cmmon32.exe	cmd.exe
PID 2872 wrote to memory of 1452	2872	cmmon32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3024

C:\Users\Admin\AppData\Local\Temp\New order.exe
"C:\Users\Admin\AppData\Local\Temp\New order.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:796

C:\Users\Admin\AppData\Local\Temp\New order.exe
"C:\Users\Admin\AppData\Local\Temp\New order.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3904

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\New order.exe"
3⤵
PID:1452

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsdA724.tmp\dpra.dll
MD5
3feb8ed49836d35cbab9f2bb9dfaa428

SHA1
c2a418b93c0bb81ef62267bfed522250321791db

SHA256
92dab948f60160d5aba56d2c8c30d83b0a7247ec4e3a8cccc74adb6ef799f051

SHA512
fe765d282f7fa205a0661f62c6023d71d08818b400c2a20fd868b8c66fdbe5a62218b570292423c1dc02c8881610f3dde55ae7dbbd86b7df3ae2e46d447ed732

Download Submit
memory/796-115-0x00000000009E0000-0x00000000009E2000-memory.dmp

Filesize
8KB

Download
memory/1452-124-0x0000000000000000-mapping.dmp

Download
memory/2872-126-0x0000000004100000-0x000000000418F000-memory.dmp

Filesize
572KB

Download
memory/2872-125-0x0000000004440000-0x0000000004760000-memory.dmp

Filesize
3.1MB

Download
memory/2872-121-0x0000000000000000-mapping.dmp

Download
memory/2872-122-0x00000000000C0000-0x00000000000CC000-memory.dmp

Filesize
48KB

Download
memory/2872-123-0x0000000002820000-0x0000000002849000-memory.dmp

Filesize
164KB

Download
memory/3024-127-0x00000000065E0000-0x00000000066E2000-memory.dmp

Filesize
1.0MB

Download
memory/3024-120-0x0000000005E30000-0x0000000005F9B000-memory.dmp

Filesize
1.4MB

Download
memory/3904-117-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3904-119-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download
memory/3904-118-0x0000000000960000-0x0000000000C80000-memory.dmp

Filesize
3.1MB

Download
memory/3904-116-0x000000000041D0C0-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads