xloader | 824dcdd9992d95e8d435c223f7ca465647106106c1115cda058a75a29dcebbdc

Analysis

max time kernel
148s
max time network
193s
platform
windows7_x64
resource
win7v20210410
submitted
20/07/2021, 06:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INVOICE.exe
Size 1.0MB
Sample210720-pdmtfffz9a
SHA256 b40f99b70dfb48d4465f825207248af9d1cdc87166bc7b5adb73a3da72b0df93
MD5 8b500a764ff3b7f2a118b197c801b0cc
SHA1 3fcbf18e9a1d6dba262ab7675ce42c03a142a220
SHA512 174c850f0bd3fd5f38d1a2288eb48990cae3a1024dbcedccf74354356dbc6808f1380c146eab5520c238bb571575aad5e5a4088939d4a23a720002c07da5b57b
MD5 SHA1 SHA512

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

http://www.jantesetaccessoires.com/p6f2/

Decoy

redsnews.com
vr859.com
postmasterstudios.com
hampsteadorganizer.com
hangshop.net
maheshwaramlawcollege.com
5156087.com
gtaaddict.com
faj.xyz
drivechicagoillinois.com
neerutech.com
b2brahmas.com
freshlookks.com
propertyparallel.tech
tlwbyads.com
sellektorkids.com
dexs.fyi
kileybrock.com
nervstudio.com
tosg-ltd.com
admibd.com
hilariousfakenews.com
lub-additive.com
securecloudinfo.com
xn--jde.com
andtheskywentred.com
nearestgreenbeverage.net
tipthemusician.com
koziolwojciech.com
ryosecurity.com
cosypromotion.com
qvvn.life
emcelt.com
ersatzair.com
blassmail.online
florianlecerf.com
shannonsmithcounseling.com
litorin.com
plusproduce.net
sandersonfarnns.com
medicservic.com
mostmegaproductions.com
eldorado88casino.com
hordlife.com
drgunjankumaribhagwat.com
iregentos.info
lifeonprimroselane.com
playstoreaddps.com
anacquiredtastepodcast.com
chinachaohuo.com
xn--80aafif4agv1ai.xn--p1acf
flmoisture.com
framebooth.net
wildhare.media
1000praises.com
tna.zone
kravmagatacticalacademy.com
jasonwang.online
suruyorum.com
concretepill.com
alfarouqco.com
reliefpaypal.com
xn--fujtherma-xpb.com
petgsafetyseal.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral3/memory/1960-64-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral3/memory/1960-65-0x000000000041D050-mapping.dmp	xloader
behavioral3/memory/1724-72-0x0000000000080000-0x00000000000A8000-memory.dmp	xloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
13	1724	cmd.exe

Deletes itself 1 IoCs

pid	Process
876	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 1960	2016	INVOICE.exe	27
PID 1960 set thread context of 1224	1960	INVOICE.exe	11
PID 1724 set thread context of 1224	1724	cmd.exe	11

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2016	INVOICE.exe
1960	INVOICE.exe
1960	INVOICE.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe
1724	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1224	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1960	INVOICE.exe
1960	INVOICE.exe
1960	INVOICE.exe
1724	cmd.exe
1724	cmd.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	INVOICE.exe
Token: SeDebugPrivilege	1960	INVOICE.exe
Token: SeDebugPrivilege	1724	cmd.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1224	Explorer.EXE
1224	Explorer.EXE
1224	Explorer.EXE
1224	Explorer.EXE

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1224	Explorer.EXE
1224	Explorer.EXE
1224	Explorer.EXE
1224	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1984	2016	INVOICE.exe	26
PID 2016 wrote to memory of 1984	2016	INVOICE.exe	26
PID 2016 wrote to memory of 1984	2016	INVOICE.exe	26
PID 2016 wrote to memory of 1984	2016	INVOICE.exe	26
PID 2016 wrote to memory of 1960	2016	INVOICE.exe	27
PID 2016 wrote to memory of 1960	2016	INVOICE.exe	27
PID 2016 wrote to memory of 1960	2016	INVOICE.exe	27
PID 2016 wrote to memory of 1960	2016	INVOICE.exe	27
PID 2016 wrote to memory of 1960	2016	INVOICE.exe	27
PID 2016 wrote to memory of 1960	2016	INVOICE.exe	27
PID 2016 wrote to memory of 1960	2016	INVOICE.exe	27
PID 1224 wrote to memory of 1724	1224	Explorer.EXE	28
PID 1224 wrote to memory of 1724	1224	Explorer.EXE	28
PID 1224 wrote to memory of 1724	1224	Explorer.EXE	28
PID 1224 wrote to memory of 1724	1224	Explorer.EXE	28
PID 1724 wrote to memory of 876	1724	cmd.exe	32
PID 1724 wrote to memory of 876	1724	cmd.exe	32
PID 1724 wrote to memory of 876	1724	cmd.exe	32
PID 1724 wrote to memory of 876	1724	cmd.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Users\Admin\AppData\Local\Temp\INVOICE.exe
  "C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Users\Admin\AppData\Local\Temp\INVOICE.exe
    "C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\INVOICE.exe
    "C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1960
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\INVOICE.exe"
    3⤵
    - Deletes itself
    PID:876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-68-0x0000000005FB0000-0x0000000006086000-memory.dmp

Download

memory/1224-75-0x0000000006FF0000-0x0000000007139000-memory.dmp

Download

memory/1724-71-0x000000004A9C0000-0x000000004AA0C000-memory.dmp

Download

memory/1724-76-0x0000000076A81000-0x0000000076A83000-memory.dmp

Download

memory/1724-74-0x00000000005C0000-0x000000000064F000-memory.dmp

Download

memory/1724-73-0x0000000002140000-0x0000000002443000-memory.dmp

Download

memory/1724-72-0x0000000000080000-0x00000000000A8000-memory.dmp

Download

memory/1960-66-0x00000000008D0000-0x0000000000BD3000-memory.dmp

Download

memory/1960-64-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1960-67-0x0000000000160000-0x0000000000170000-memory.dmp

Download

memory/2016-62-0x00000000003C0000-0x00000000003CF000-memory.dmp

Download

memory/2016-63-0x0000000004C30000-0x0000000004C31000-memory.dmp

Download

memory/2016-59-0x00000000011B0000-0x00000000011B1000-memory.dmp

Download

memory/2016-61-0x0000000001000000-0x000000000107B000-memory.dmp

Download