xloader | 4b5ebfee6d9719c8f11ab46444ba5c2c803acacb095ac868eaee346924976d77

Analysis

max time kernel
150s
max time network
146s
platform
windows10_x64
resource
win10v20210408
submitted
15/06/2021, 06:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RE Purchase Order.exe
Size 217KB
Sample210615-cmab72aejj
SHA256 4b5ebfee6d9719c8f11ab46444ba5c2c803acacb095ac868eaee346924976d77
MD5 7a07e240643138074d0c7a0808a28ddf
SHA1 997229ecdcc783114ee789b422401a0030967b8e
SHA512 abf89c783e39437f9d8ece65980d2da3eff04c5a25bb8d609f720e355f70ae2dc0db6dfb10fb4a79928a1d02d76e534398f9ccc940c9ef36094d27a0a70b35c6
MD5 SHA1 SHA512

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

http://www.yunastone.com/u6e4/

Decoy

seospecialised.com
acrostuttgart.com
tbluedotpanowdshop.com
holleyjohnson.net
kimloc.com
he693thm166.com
dahumblehustla.com
cestsansgluten.net
woxingame.com
worldleadersretail.com
esmcharts.com
lovelivehuntingtonbeach.com
komorebi-id.com
blissburg.site
businessloansug.com
willorv.com
nordsyron.com
katebrighton.com
sweet999.com
antimicrobialkiosk.com
zpokasil.com
teengen.today
cindyshairofdistinction.com
prpdigital.com
svenskagourmet.com
forloveofwords.com
wequassettacademy.com
player0.xyz
onlyheat.net
fortrestpool.com
wonderyearsplayschool.com
lkrefkldklerfkklef.com
oran-id101.club
parentue.com
skincarezwolle.com
letsq.info
sprtncloud.com
pfg-aero.com
yoperro.net
meetzeedzaab.com
xn--80aeingrcwdeeaee.xn--p1acf
betterglazing.com
postingyourvideos.com
detegelboer.com
monroesbowtique.com
brisswicks.com
ethnicbucket.com
jackgaughan.net
nuskinhk.com
zgwljypx.com
getemcooking.com
metime1111.com
2bluepigs.com
yourcreativeconsultantgroup.com
blinbins.com
ruckfree.com
mikerack.com
downtoearthwork.com
uxdnxodpo.icu
lilycartoons.com
yihetubu.com
digho.online
sigsauerheadquarters.com
worldhookupguides.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/3936-117-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral2/memory/384-123-0x0000000003240000-0x0000000003268000-memory.dmp	xloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
39	384	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
1032	RE Purchase Order.exe
1032	RE Purchase Order.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1032 set thread context of 3936	1032	RE Purchase Order.exe	75
PID 3936 set thread context of 2740	3936	RE Purchase Order.exe	28
PID 384 set thread context of 2740	384	rundll32.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1032	RE Purchase Order.exe
1032	RE Purchase Order.exe
1032	RE Purchase Order.exe
1032	RE Purchase Order.exe
1032	RE Purchase Order.exe
1032	RE Purchase Order.exe
1032	RE Purchase Order.exe
1032	RE Purchase Order.exe
3936	RE Purchase Order.exe
3936	RE Purchase Order.exe
3936	RE Purchase Order.exe
3936	RE Purchase Order.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe
384	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2740	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1032	RE Purchase Order.exe
3936	RE Purchase Order.exe
3936	RE Purchase Order.exe
3936	RE Purchase Order.exe
384	rundll32.exe
384	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3936	RE Purchase Order.exe
Token: SeDebugPrivilege	384	rundll32.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2740	Explorer.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 3936	1032	RE Purchase Order.exe	75
PID 1032 wrote to memory of 3936	1032	RE Purchase Order.exe	75
PID 1032 wrote to memory of 3936	1032	RE Purchase Order.exe	75
PID 1032 wrote to memory of 3936	1032	RE Purchase Order.exe	75
PID 2740 wrote to memory of 384	2740	Explorer.EXE	76
PID 2740 wrote to memory of 384	2740	Explorer.EXE	76
PID 2740 wrote to memory of 384	2740	Explorer.EXE	76
PID 384 wrote to memory of 3344	384	rundll32.exe	79
PID 384 wrote to memory of 3344	384	rundll32.exe	79
PID 384 wrote to memory of 3344	384	rundll32.exe	79

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\RE Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\RE Purchase Order.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Users\Admin\AppData\Local\Temp\RE Purchase Order.exe
    "C:\Users\Admin\AppData\Local\Temp\RE Purchase Order.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3936
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\SysWOW64\rundll32.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\RE Purchase Order.exe"
    3⤵
    PID:3344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-126-0x0000000004EE0000-0x0000000004F6F000-memory.dmp

Download

memory/384-125-0x0000000005090000-0x00000000053B0000-memory.dmp

Download

memory/384-123-0x0000000003240000-0x0000000003268000-memory.dmp

Download

memory/384-122-0x0000000001210000-0x0000000001223000-memory.dmp

Download

memory/2740-127-0x0000000005810000-0x00000000058E3000-memory.dmp

Download

memory/2740-120-0x00000000056E0000-0x000000000580E000-memory.dmp

Download

memory/3936-118-0x00000000009F0000-0x0000000000D10000-memory.dmp

Download

memory/3936-117-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3936-119-0x00000000009B0000-0x00000000009C0000-memory.dmp

Download