xloader | 38ba862149962bc5a10825a2b818391624cda439fcb3f6212b75d84eeeb4f70c

General

Target

18e38eae3d407418b879271c9b5736bd.exe
Size

664KB
MD5

18e38eae3d407418b879271c9b5736bd
SHA1

922687da4673862f203b62884ac6a2cfb49790d3
SHA256

38ba862149962bc5a10825a2b818391624cda439fcb3f6212b75d84eeeb4f70c
SHA512

2ece524bd152c58d42cc12331f218abb5f60f3e4a9d41e7927d2e76d72a07061aa07fb18d90d329a072734bf39334171ec16e2ba0005f468f8b27a14269a71c9

Score

10^/10

xloader loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.naturalresourcesmgt.com/bsk9/

Decoy

ignitedennys.com

theawslearn.net

tuningyan.wiki

professionalboom.com

btt3d.online

ceyaqua.com

knightslunarius.com

zc168sl.com

girlsnightclasses.com

tcsalud.com

homecottagestudio.com

92gwb.com

stainlesslion.com

arunkapur.com

chalkwithkristi.com

yourmidastouch.com

wijayashaw.com

roofingcompanyinchattanooga.com

sdbadatong.com

tombison.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2840-115-0x0000000000000000-mapping.dmp	xloader
behavioral2/memory/2840-117-0x0000000010410000-0x0000000010438000-memory.dmp	xloader
behavioral2/memory/2032-125-0x0000000000CA0000-0x0000000000CC8000-memory.dmp	xloader

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

46 2032 msiexec.exe

flow	pid	process
46	2032	msiexec.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

mshta.exemsiexec.exe

description	pid	process	target process
PID 2840 set thread context of 3064	2840	mshta.exe	Explorer.EXE
PID 2032 set thread context of 3064	2032	msiexec.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

mshta.exemsiexec.exe

pid	process
2840	mshta.exe
2840	mshta.exe
2840	mshta.exe
2840	mshta.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe
2032	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3064 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

mshta.exemsiexec.exe

pid process

2840 mshta.exe
2840 mshta.exe
2840 mshta.exe
2032 msiexec.exe
2032 msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

mshta.exemsiexec.exe

description pid process

Token: SeDebugPrivilege 2840 mshta.exe
Token: SeDebugPrivilege 2032 msiexec.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3064 Explorer.EXE

pid	process
3064	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	2840	mshta.exe
Token: SeDebugPrivilege	2032	msiexec.exe

pid	process
3064	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

18e38eae3d407418b879271c9b5736bd.exeExplorer.EXEmsiexec.exe

description	pid	process	target process
PID 4040 wrote to memory of 2840	4040	18e38eae3d407418b879271c9b5736bd.exe	mshta.exe
PID 4040 wrote to memory of 2840	4040	18e38eae3d407418b879271c9b5736bd.exe	mshta.exe
PID 4040 wrote to memory of 2840	4040	18e38eae3d407418b879271c9b5736bd.exe	mshta.exe
PID 4040 wrote to memory of 2840	4040	18e38eae3d407418b879271c9b5736bd.exe	mshta.exe
PID 4040 wrote to memory of 2840	4040	18e38eae3d407418b879271c9b5736bd.exe	mshta.exe
PID 4040 wrote to memory of 2840	4040	18e38eae3d407418b879271c9b5736bd.exe	mshta.exe
PID 3064 wrote to memory of 2032	3064	Explorer.EXE	msiexec.exe
PID 3064 wrote to memory of 2032	3064	Explorer.EXE	msiexec.exe
PID 3064 wrote to memory of 2032	3064	Explorer.EXE	msiexec.exe
PID 2032 wrote to memory of 4048	2032	msiexec.exe	cmd.exe
PID 2032 wrote to memory of 4048	2032	msiexec.exe	cmd.exe
PID 2032 wrote to memory of 4048	2032	msiexec.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3064

C:\Users\Admin\AppData\Local\Temp\18e38eae3d407418b879271c9b5736bd.exe
"C:\Users\Admin\AppData\Local\Temp\18e38eae3d407418b879271c9b5736bd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4040

C:\Windows\SysWOW64\mshta.exe
C:\Windows\System32\mshta.exe
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\SysWOW64\mshta.exe"
3⤵
PID:4048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-121-0x0000000000000000-mapping.dmp

Download
memory/2032-128-0x0000000004B90000-0x0000000004C1F000-memory.dmp

Filesize
572KB

Download
memory/2032-127-0x0000000004E40000-0x0000000005160000-memory.dmp

Filesize
3.1MB

Download
memory/2032-125-0x0000000000CA0000-0x0000000000CC8000-memory.dmp

Filesize
160KB

Download
memory/2032-124-0x0000000000D00000-0x0000000000D12000-memory.dmp

Filesize
72KB

Download
memory/2840-116-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/2840-119-0x00000000009D0000-0x00000000009E0000-memory.dmp

Filesize
64KB

Download
memory/2840-118-0x0000000003040000-0x0000000003360000-memory.dmp

Filesize
3.1MB

Download
memory/2840-117-0x0000000010410000-0x0000000010438000-memory.dmp

Filesize
160KB

Download
memory/2840-115-0x0000000000000000-mapping.dmp

Download
memory/3064-120-0x0000000004DB0000-0x0000000004EE2000-memory.dmp

Filesize
1.2MB

Download
memory/3064-129-0x0000000005E40000-0x0000000005FC9000-memory.dmp

Filesize
1.5MB

Download
memory/4040-114-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/4048-126-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads