xloader | 977576652c35a9f68bd5e609bc4628b521ee75dfa0b0d9d82deb6de35ad0d080

General

Target
Invoice BL Packing List.exe
Size 789KB
Sample210902-q8pevsdbdr
SHA256 977576652c35a9f68bd5e609bc4628b521ee75dfa0b0d9d82deb6de35ad0d080
MD5 1ff46d48d359f79c2e52a9cdb71109a6
SHA1 7b9d4317d7539aeef7abb3b3df872b8423fabae6
SHA512 03654d2df2517c4419ec22ad79e842811f6abf7e16e61cbeaed606a92635759bbbec7cc31717d2d5e24e4438762a87ba46433295a982311269ae8fb3c2b4bba2
MD5 SHA1 SHA512

Score

10^/10

xloader bmg0 loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

bmg0

C2

http://www.bestpivotpoints.com/bmg0/

Decoy

upholsterybelle.com
griddlpress.com
easymove.limited
bridgingthewordintlministry.net
webgezgini.com
losangeles-divorce-lawyer.com
kos-living.com
arcadems.com
tuccijbeats.com
thecgchurch.com
dtkh58.com
stevieknows.com
perebet299.com
honeyandolivephotography.com
wujuenong.net
automobiliatint.com
festaki.com
injectionhub.com
lovekemah.com
bellantoniformazione.com
km610.xyz
luminards.com
xn--80akjfdc1bgef.xn--p1acf
smilehn.com
cherisedtreasures.com
altamirasound.com
blacklikemestore.com
tonysimsii.com
directingandfilming.com
jaysseafoodandsteaks.com
mynifgi8.com
cerro.wine
rexploremassageandrocks.com
myloginpro.com
thishasit.com
juxiantc.com
globalbiosec.com
mlppark-unna.com
autoenginerepair.com
watersedgenottingham.com
c77-77lotto.net
malpracticeattorneyscenter.info
orangetreervpark.com
kiransa.com
computable.xyz
crttestkiti.site
darrenblogs.com
johnkessinger.com
abnfnleoba.club
purenarcotic.com
marioatha.com
educacionmarketing.com
imcuteinside.com
vneducation.net
trumpa2z.com
kargotakipsistem.com
rjd65.com
pichesaccessories.com
creatunegocioonline.com
earthwishcustompieces.com
freaky-five.com
hopesingleton.com
zaza005.xyz
duffelglimmer.icu

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/564-65-0x000000000041D070-mapping.dmp	xloader
behavioral1/memory/564-64-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/568-71-0x00000000000D0000-0x00000000000F9000-memory.dmp	xloader

Deletes itself 1 IoCs

pid	Process
1740	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1032 set thread context of 564	1032	Invoice BL Packing List.exe	31
PID 564 set thread context of 1204	564	Invoice BL Packing List.exe	9
PID 568 set thread context of 1204	568	wuapp.exe	9

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
564	Invoice BL Packing List.exe
564	Invoice BL Packing List.exe
568	wuapp.exe
568	wuapp.exe
568	wuapp.exe
568	wuapp.exe
568	wuapp.exe
568	wuapp.exe
568	wuapp.exe
568	wuapp.exe
568	wuapp.exe
568	wuapp.exe
568	wuapp.exe
568	wuapp.exe
568	wuapp.exe
568	wuapp.exe
568	wuapp.exe
568	wuapp.exe
568	wuapp.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
564	Invoice BL Packing List.exe
564	Invoice BL Packing List.exe
564	Invoice BL Packing List.exe
568	wuapp.exe
568	wuapp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	564	Invoice BL Packing List.exe
Token: SeDebugPrivilege	568	wuapp.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 520	1032	Invoice BL Packing List.exe	29
PID 1032 wrote to memory of 520	1032	Invoice BL Packing List.exe	29
PID 1032 wrote to memory of 520	1032	Invoice BL Packing List.exe	29
PID 1032 wrote to memory of 520	1032	Invoice BL Packing List.exe	29
PID 1032 wrote to memory of 564	1032	Invoice BL Packing List.exe	31
PID 1032 wrote to memory of 564	1032	Invoice BL Packing List.exe	31
PID 1032 wrote to memory of 564	1032	Invoice BL Packing List.exe	31
PID 1032 wrote to memory of 564	1032	Invoice BL Packing List.exe	31
PID 1032 wrote to memory of 564	1032	Invoice BL Packing List.exe	31
PID 1032 wrote to memory of 564	1032	Invoice BL Packing List.exe	31
PID 1032 wrote to memory of 564	1032	Invoice BL Packing List.exe	31
PID 1204 wrote to memory of 568	1204	Explorer.EXE	32
PID 1204 wrote to memory of 568	1204	Explorer.EXE	32
PID 1204 wrote to memory of 568	1204	Explorer.EXE	32
PID 1204 wrote to memory of 568	1204	Explorer.EXE	32
PID 1204 wrote to memory of 568	1204	Explorer.EXE	32
PID 1204 wrote to memory of 568	1204	Explorer.EXE	32
PID 1204 wrote to memory of 568	1204	Explorer.EXE	32
PID 568 wrote to memory of 1740	568	wuapp.exe	33
PID 568 wrote to memory of 1740	568	wuapp.exe	33
PID 568 wrote to memory of 1740	568	wuapp.exe	33
PID 568 wrote to memory of 1740	568	wuapp.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\Invoice BL Packing List.exe
  "C:\Users\Admin\AppData\Local\Temp\Invoice BL Packing List.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kOlstkDbrx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4A3A.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:520
- - C:\Users\Admin\AppData\Local\Temp\Invoice BL Packing List.exe
    "C:\Users\Admin\AppData\Local\Temp\Invoice BL Packing List.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:564
- C:\Windows\SysWOW64\wuapp.exe
  "C:\Windows\SysWOW64\wuapp.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:568
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Invoice BL Packing List.exe"
    3⤵
    - Deletes itself
    PID:1740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-66-0x00000000008F0000-0x0000000000BF3000-memory.dmp

Download

memory/564-64-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/564-67-0x0000000000350000-0x0000000000361000-memory.dmp

Download

memory/568-73-0x0000000002050000-0x0000000002353000-memory.dmp

Download

memory/568-70-0x00000000003E0000-0x00000000003EB000-memory.dmp

Download

memory/568-71-0x00000000000D0000-0x00000000000F9000-memory.dmp

Download

memory/568-74-0x00000000006D0000-0x0000000000760000-memory.dmp

Download

memory/1032-62-0x00000000021E1000-0x00000000021E2000-memory.dmp

Download

memory/1032-61-0x00000000021E0000-0x00000000021E1000-memory.dmp

Download

memory/1032-60-0x0000000075801000-0x0000000075803000-memory.dmp

Download

memory/1204-68-0x00000000061B0000-0x000000000628A000-memory.dmp

Download

memory/1204-75-0x0000000003F60000-0x0000000004022000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads