xloader | b77823f69e443a341655444b0f2f2f985fa078cb768470d8d20548cf7a441584

General

Target

Booking and Shipping Reference Details.exe
Size

764KB
MD5

261e1d3d96af2d57fabdf9295a6ad987
SHA1

4be2f141e6862bbf8a79bac4900a211008ac6e68
SHA256

468169b4fe61a81e910c9b820d46694ad3e089e7d276831e690f86012db80195
SHA512

0307ea1169f2193c513af63aadb10fa3a3f0c9bae5767997e940085572150e0db8480cbf4a72dc8795e78570250f0342eec768d8eb63c731519f3091ddec9a05

Score

10^/10

xloader u86g loader persistence rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

u86g

C2

http://www.99356a.com/u86g/

Decoy

agenciaplim.com

fastpage.info

tiantianbd.com

hanedanpirlanta.com

project1accessories.com

rebeccadoumet.com

vrdnfz.com

jeaninesatl.com

isaakwallihconstruction.com

aegis.cloud

tigerandsnow.com

thehappyadventurer.com

ahhazu.com

hiveplushoney.com

k-plan-ning.com

peresvet.one

darkworkcustoms.com

deathbok.com

blackinkswizz.com

077sb.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1356-124-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral2/memory/1356-125-0x000000000041D020-mapping.dmp	xloader
behavioral2/memory/3852-131-0x0000000002BA0000-0x0000000002BC8000-memory.dmp	xloader
behavioral2/memory/2204-153-0x000000000041D020-mapping.dmp	xloader

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ipconfig.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ipconfig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\XNV4ANBPP = "C:\\Program Files (x86)\\Garidu\\regsvcavmhadz.exe"	ipconfig.exe

Executes dropped EXE 2 IoCs

Processes:

regsvcavmhadz.exeregsvcavmhadz.exe

pid process

3540 regsvcavmhadz.exe
2204 regsvcavmhadz.exe

pid	process
3540	regsvcavmhadz.exe
2204	regsvcavmhadz.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

Booking and Shipping Reference Details.exeBooking and Shipping Reference Details.exeipconfig.exeregsvcavmhadz.exe

description	pid	process	target process
PID 1012 set thread context of 1356	1012	Booking and Shipping Reference Details.exe	Booking and Shipping Reference Details.exe
PID 1356 set thread context of 2568	1356	Booking and Shipping Reference Details.exe	Explorer.EXE
PID 3852 set thread context of 2568	3852	ipconfig.exe	Explorer.EXE
PID 3540 set thread context of 2204	3540	regsvcavmhadz.exe	regsvcavmhadz.exe

Drops file in Program Files directory 4 IoCs

Processes:

Explorer.EXEipconfig.exe

description	ioc	process
File created	C:\Program Files (x86)\Garidu\regsvcavmhadz.exe	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Garidu\regsvcavmhadz.exe	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Garidu\regsvcavmhadz.exe	ipconfig.exe
File opened for modification	C:\Program Files (x86)\Garidu	Explorer.EXE

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

3852 ipconfig.exe

pid	process
3852	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

ipconfig.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Booking and Shipping Reference Details.exeBooking and Shipping Reference Details.exeipconfig.exe

pid	process
1012	Booking and Shipping Reference Details.exe
1012	Booking and Shipping Reference Details.exe
1356	Booking and Shipping Reference Details.exe
1356	Booking and Shipping Reference Details.exe
1356	Booking and Shipping Reference Details.exe
1356	Booking and Shipping Reference Details.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2568 Explorer.EXE

pid	process
2568	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

Booking and Shipping Reference Details.exeipconfig.exe

pid	process
1356	Booking and Shipping Reference Details.exe
1356	Booking and Shipping Reference Details.exe
1356	Booking and Shipping Reference Details.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe
3852	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

Processes:

Booking and Shipping Reference Details.exeBooking and Shipping Reference Details.exeipconfig.exeExplorer.EXEregsvcavmhadz.exeregsvcavmhadz.exe

description	pid	process
Token: SeDebugPrivilege	1012	Booking and Shipping Reference Details.exe
Token: SeDebugPrivilege	1356	Booking and Shipping Reference Details.exe
Token: SeDebugPrivilege	3852	ipconfig.exe
Token: SeShutdownPrivilege	2568	Explorer.EXE
Token: SeCreatePagefilePrivilege	2568	Explorer.EXE
Token: SeShutdownPrivilege	2568	Explorer.EXE
Token: SeCreatePagefilePrivilege	2568	Explorer.EXE
Token: SeShutdownPrivilege	2568	Explorer.EXE
Token: SeCreatePagefilePrivilege	2568	Explorer.EXE
Token: SeDebugPrivilege	3540	regsvcavmhadz.exe
Token: SeShutdownPrivilege	2568	Explorer.EXE
Token: SeCreatePagefilePrivilege	2568	Explorer.EXE
Token: SeShutdownPrivilege	2568	Explorer.EXE
Token: SeCreatePagefilePrivilege	2568	Explorer.EXE
Token: SeShutdownPrivilege	2568	Explorer.EXE
Token: SeCreatePagefilePrivilege	2568	Explorer.EXE
Token: SeShutdownPrivilege	2568	Explorer.EXE
Token: SeCreatePagefilePrivilege	2568	Explorer.EXE
Token: SeDebugPrivilege	2204	regsvcavmhadz.exe
Token: SeShutdownPrivilege	2568	Explorer.EXE
Token: SeCreatePagefilePrivilege	2568	Explorer.EXE
Token: SeShutdownPrivilege	2568	Explorer.EXE
Token: SeCreatePagefilePrivilege	2568	Explorer.EXE
Token: SeShutdownPrivilege	2568	Explorer.EXE
Token: SeCreatePagefilePrivilege	2568	Explorer.EXE
Token: SeShutdownPrivilege	2568	Explorer.EXE
Token: SeCreatePagefilePrivilege	2568	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

2568 Explorer.EXE

pid	process
2568	Explorer.EXE

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

Booking and Shipping Reference Details.exeExplorer.EXEipconfig.exeregsvcavmhadz.exe

description	pid	process	target process
PID 1012 wrote to memory of 1356	1012	Booking and Shipping Reference Details.exe	Booking and Shipping Reference Details.exe
PID 1012 wrote to memory of 1356	1012	Booking and Shipping Reference Details.exe	Booking and Shipping Reference Details.exe
PID 1012 wrote to memory of 1356	1012	Booking and Shipping Reference Details.exe	Booking and Shipping Reference Details.exe
PID 1012 wrote to memory of 1356	1012	Booking and Shipping Reference Details.exe	Booking and Shipping Reference Details.exe
PID 1012 wrote to memory of 1356	1012	Booking and Shipping Reference Details.exe	Booking and Shipping Reference Details.exe
PID 1012 wrote to memory of 1356	1012	Booking and Shipping Reference Details.exe	Booking and Shipping Reference Details.exe
PID 2568 wrote to memory of 3852	2568	Explorer.EXE	ipconfig.exe
PID 2568 wrote to memory of 3852	2568	Explorer.EXE	ipconfig.exe
PID 2568 wrote to memory of 3852	2568	Explorer.EXE	ipconfig.exe
PID 3852 wrote to memory of 1564	3852	ipconfig.exe	cmd.exe
PID 3852 wrote to memory of 1564	3852	ipconfig.exe	cmd.exe
PID 3852 wrote to memory of 1564	3852	ipconfig.exe	cmd.exe
PID 3852 wrote to memory of 3188	3852	ipconfig.exe	Firefox.exe
PID 3852 wrote to memory of 3188	3852	ipconfig.exe	Firefox.exe
PID 2568 wrote to memory of 3540	2568	Explorer.EXE	regsvcavmhadz.exe
PID 2568 wrote to memory of 3540	2568	Explorer.EXE	regsvcavmhadz.exe
PID 2568 wrote to memory of 3540	2568	Explorer.EXE	regsvcavmhadz.exe
PID 3852 wrote to memory of 3188	3852	ipconfig.exe	Firefox.exe
PID 3540 wrote to memory of 2204	3540	regsvcavmhadz.exe	regsvcavmhadz.exe
PID 3540 wrote to memory of 2204	3540	regsvcavmhadz.exe	regsvcavmhadz.exe
PID 3540 wrote to memory of 2204	3540	regsvcavmhadz.exe	regsvcavmhadz.exe
PID 3540 wrote to memory of 2204	3540	regsvcavmhadz.exe	regsvcavmhadz.exe
PID 3540 wrote to memory of 2204	3540	regsvcavmhadz.exe	regsvcavmhadz.exe
PID 3540 wrote to memory of 2204	3540	regsvcavmhadz.exe	regsvcavmhadz.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Users\Admin\AppData\Local\Temp\Booking and Shipping Reference Details.exe
  "C:\Users\Admin\AppData\Local\Temp\Booking and Shipping Reference Details.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Users\Admin\AppData\Local\Temp\Booking and Shipping Reference Details.exe
    "C:\Users\Admin\AppData\Local\Temp\Booking and Shipping Reference Details.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1356
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\SysWOW64\ipconfig.exe"
  2⤵
  - Adds policy Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Gathers network information
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Booking and Shipping Reference Details.exe"
    3⤵
    PID:1564
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:3188
- C:\Program Files (x86)\Garidu\regsvcavmhadz.exe
  "C:\Program Files (x86)\Garidu\regsvcavmhadz.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Program Files (x86)\Garidu\regsvcavmhadz.exe
    "C:\Program Files (x86)\Garidu\regsvcavmhadz.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Garidu\regsvcavmhadz.exe

MD5
261e1d3d96af2d57fabdf9295a6ad987

SHA1
4be2f141e6862bbf8a79bac4900a211008ac6e68

SHA256
468169b4fe61a81e910c9b820d46694ad3e089e7d276831e690f86012db80195

SHA512
0307ea1169f2193c513af63aadb10fa3a3f0c9bae5767997e940085572150e0db8480cbf4a72dc8795e78570250f0342eec768d8eb63c731519f3091ddec9a05

Download Submit
C:\Program Files (x86)\Garidu\regsvcavmhadz.exe

MD5
261e1d3d96af2d57fabdf9295a6ad987

SHA1
4be2f141e6862bbf8a79bac4900a211008ac6e68

SHA256
468169b4fe61a81e910c9b820d46694ad3e089e7d276831e690f86012db80195

SHA512
0307ea1169f2193c513af63aadb10fa3a3f0c9bae5767997e940085572150e0db8480cbf4a72dc8795e78570250f0342eec768d8eb63c731519f3091ddec9a05

Download Submit
C:\Program Files (x86)\Garidu\regsvcavmhadz.exe

MD5
261e1d3d96af2d57fabdf9295a6ad987

SHA1
4be2f141e6862bbf8a79bac4900a211008ac6e68

SHA256
468169b4fe61a81e910c9b820d46694ad3e089e7d276831e690f86012db80195

SHA512
0307ea1169f2193c513af63aadb10fa3a3f0c9bae5767997e940085572150e0db8480cbf4a72dc8795e78570250f0342eec768d8eb63c731519f3091ddec9a05

Download Submit
memory/1012-122-0x0000000009260000-0x00000000092C9000-memory.dmp

Filesize
420KB

Download
memory/1012-117-0x0000000005940000-0x0000000005941000-memory.dmp

Filesize
4KB

Download
memory/1012-120-0x0000000009100000-0x0000000009116000-memory.dmp

Filesize
88KB

Download
memory/1012-121-0x00000000091C0000-0x00000000091C1000-memory.dmp

Filesize
4KB

Download
memory/1012-114-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/1012-123-0x000000000BA40000-0x000000000BA73000-memory.dmp

Filesize
204KB

Download
memory/1012-118-0x0000000005860000-0x0000000005D5E000-memory.dmp

Filesize
5.0MB

Download
memory/1012-116-0x0000000005D60000-0x0000000005D61000-memory.dmp

Filesize
4KB

Download
memory/1012-119-0x00000000059E0000-0x00000000059E1000-memory.dmp

Filesize
4KB

Download
memory/1356-125-0x000000000041D020-mapping.dmp

Download
memory/1356-127-0x00000000009F0000-0x0000000000A00000-memory.dmp

Filesize
64KB

Download
memory/1356-126-0x00000000012F0000-0x0000000001610000-memory.dmp

Filesize
3.1MB

Download
memory/1356-124-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1564-132-0x0000000000000000-mapping.dmp

Download
memory/2204-155-0x0000000001190000-0x00000000014B0000-memory.dmp

Filesize
3.1MB

Download
memory/2204-153-0x000000000041D020-mapping.dmp

Download
memory/2568-135-0x0000000006610000-0x000000000673E000-memory.dmp

Filesize
1.2MB

Download
memory/2568-128-0x00000000064E0000-0x000000000660E000-memory.dmp

Filesize
1.2MB

Download
memory/3188-149-0x0000027B819A0000-0x0000027B81A7A000-memory.dmp

Filesize
872KB

Download
memory/3188-148-0x00007FF655CC0000-0x00007FF655D53000-memory.dmp

Filesize
588KB

Download
memory/3188-147-0x0000000000000000-mapping.dmp

Download
memory/3540-136-0x0000000000000000-mapping.dmp

Download
memory/3540-144-0x0000000005690000-0x0000000005B8E000-memory.dmp

Filesize
5.0MB

Download
memory/3852-134-0x0000000003330000-0x00000000033BF000-memory.dmp

Filesize
572KB

Download
memory/3852-133-0x0000000002F80000-0x00000000032A0000-memory.dmp

Filesize
3.1MB

Download
memory/3852-130-0x00000000001F0000-0x00000000001FB000-memory.dmp

Filesize
44KB

Download
memory/3852-131-0x0000000002BA0000-0x0000000002BC8000-memory.dmp

Filesize
160KB

Download
memory/3852-129-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads