xloader | aace20e28e61cb328da74ff938231b1ce9a07498d477efe3efc5c5d3d04b9dc1

General

Target
Citvonvhciktufwvyzyhistnewdjgsoqdr.exe
Size 704KB
Sample210510-dsm2rxmhvs
SHA256 aace20e28e61cb328da74ff938231b1ce9a07498d477efe3efc5c5d3d04b9dc1
MD5 4e71f90d1817f44313f4e101ef393968
SHA1 3932f9822134761e7bf9bc1902f8cc28b6820559
SHA512 a50c0e27009521b2f34358fb3bc30afb661b75cb6ba715ac8be15f412b50600dc3a474bd90de74c1e1b3941f3bc0d80c7b7e16aa26969a4250ec7f4dcd234419
MD5 SHA1 SHA512

Score

10^/10

xloader loader persistence rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.clinics.life/qku9/

Decoy

infinitilifecenters.com
newsondogs.com
enonen.com
skinnybrew.asia
evaair-dailoan.com
kakao.delivery
kenistic.com
dichvuquatanghtc.com
avbs1.xyz
dornhome.com
uuyuii.com
elearningeasygenerator.com
basnne.com
snkrclassics.com
healthtechcentral.com
earthhoodpal.com
voorgoed.com
lazycooked.com
openrank.site
georgeswebwerks.com
diabluma.com
kenekch.net
fragrans.paris
dov12.com
traumainformed.love
rocket3freedom.com
smartgrowcultiva.com
financial345.com
maxsecuritycompany.com
ibitr.com
tamhoo.com
reciclar.space
agustoscimerapk-tr.com
risingstarg.com
kambosito.space
bossdeal.online
xn--avenr-wsa.com
tauznora.com
rest-blog.com
amercadear.com
xn--e1agggwgm.xn--p1acf
paintwaterlilly.com
yago.pro
kmakeupbrushes.com
shawnshimazu.design
homeverf.com
latromi.com
machacekbakery.com
jillsfreegift.com
nationwidemovingamerica.com
healthyred.xyz
thrg33.club
orbit-shop.com
akgunreklam.xyz
vewesyqy.xyz
contorig2.com
reiadarealestate.com
pmxgear.com
chennaigranites.com
jmboprivacy.com
genunid.com
alegria.club
alexfuture.net
anixussohigh.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/1144-115-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral2/memory/1144-116-0x000000000041CF40-mapping.dmp	xloader

Executes dropped EXE 1 IoCs

pid	Process
3964	Netplwiz.exe

Loads dropped DLL 1 IoCs

pid	Process
3964	Netplwiz.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Citvon = "C:\\Users\\Public\\novtiC.url"	Citvonvhciktufwvyzyhistnewdjgsoqdr.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1828 set thread context of 1144	1828	Citvonvhciktufwvyzyhistnewdjgsoqdr.exe	79

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1144	Citvonvhciktufwvyzyhistnewdjgsoqdr.exe
1144	Citvonvhciktufwvyzyhistnewdjgsoqdr.exe
2740	powershell.exe
2740	powershell.exe
2740	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeIncreaseQuotaPrivilege	2740	powershell.exe
Token: SeSecurityPrivilege	2740	powershell.exe
Token: SeTakeOwnershipPrivilege	2740	powershell.exe
Token: SeLoadDriverPrivilege	2740	powershell.exe
Token: SeSystemProfilePrivilege	2740	powershell.exe
Token: SeSystemtimePrivilege	2740	powershell.exe
Token: SeProfSingleProcessPrivilege	2740	powershell.exe
Token: SeIncBasePriorityPrivilege	2740	powershell.exe
Token: SeCreatePagefilePrivilege	2740	powershell.exe
Token: SeBackupPrivilege	2740	powershell.exe
Token: SeRestorePrivilege	2740	powershell.exe
Token: SeShutdownPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeSystemEnvironmentPrivilege	2740	powershell.exe
Token: SeRemoteShutdownPrivilege	2740	powershell.exe
Token: SeUndockPrivilege	2740	powershell.exe
Token: SeManageVolumePrivilege	2740	powershell.exe
Token: 33	2740	powershell.exe
Token: 34	2740	powershell.exe
Token: 35	2740	powershell.exe
Token: 36	2740	powershell.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1144	1828	Citvonvhciktufwvyzyhistnewdjgsoqdr.exe	79
PID 1828 wrote to memory of 1144	1828	Citvonvhciktufwvyzyhistnewdjgsoqdr.exe	79
PID 1828 wrote to memory of 1144	1828	Citvonvhciktufwvyzyhistnewdjgsoqdr.exe	79
PID 1828 wrote to memory of 1144	1828	Citvonvhciktufwvyzyhistnewdjgsoqdr.exe	79
PID 1828 wrote to memory of 1144	1828	Citvonvhciktufwvyzyhistnewdjgsoqdr.exe	79
PID 1828 wrote to memory of 1140	1828	Citvonvhciktufwvyzyhistnewdjgsoqdr.exe	80
PID 1828 wrote to memory of 1140	1828	Citvonvhciktufwvyzyhistnewdjgsoqdr.exe	80
PID 1828 wrote to memory of 1140	1828	Citvonvhciktufwvyzyhistnewdjgsoqdr.exe	80
PID 1140 wrote to memory of 2080	1140	cmd.exe	82
PID 1140 wrote to memory of 2080	1140	cmd.exe	82
PID 1140 wrote to memory of 2080	1140	cmd.exe	82
PID 2080 wrote to memory of 3964	2080	cmd.exe	84
PID 2080 wrote to memory of 3964	2080	cmd.exe	84
PID 3964 wrote to memory of 2420	3964	Netplwiz.exe	85
PID 3964 wrote to memory of 2420	3964	Netplwiz.exe	85
PID 2420 wrote to memory of 2740	2420	cmd.exe	87
PID 2420 wrote to memory of 2740	2420	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe
"C:\Users\Admin\AppData\Local\Temp\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Users\Admin\AppData\Local\Temp\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe
  C:\Users\Admin\AppData\Local\Temp\Citvonvhciktufwvyzyhistnewdjgsoqdr.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\stt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\PXOR.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Windows \System32\Netplwiz.exe
      "C:\Windows \System32\Netplwiz.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:3964
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Users\Public\Cdex.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2420
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1144-131-0x00000000009C0000-0x0000000000CE0000-memory.dmp

Download

memory/1144-115-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1828-114-0x0000000000560000-0x000000000060E000-memory.dmp

Download

memory/2740-137-0x0000022F34730000-0x0000022F34731000-memory.dmp

Download

memory/2740-142-0x0000022F4E9F0000-0x0000022F4E9F1000-memory.dmp

Download

memory/2740-163-0x0000022F34723000-0x0000022F34725000-memory.dmp

Download

memory/2740-162-0x0000022F34720000-0x0000022F34722000-memory.dmp

Download

memory/2740-165-0x0000022F34726000-0x0000022F34728000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads