GLEASON_QT2309.exe

General
Target

GLEASON_QT2309.exe

Filesize

642KB

Completed

24-09-2021 11:24

Score
10 /10
MD5

d601604552146dd9a412f1db8ff0cdd4

SHA1

8dc649c53d100c5d1f1330dc5ba33c680208d7f8

SHA256

3121d773a680fbac7dc37f75c38ae8ef20f1b88915cc0b83ca9bf2bf7c22ee94

Malware Config

Extracted

Family xloader
Version 2.5
Campaign g9vg
C2

http://www.supra413.com/g9vg/

Decoy

selenebrennan.com

htsfrance.com

monsieurtechno.com

argosy.city

lit-clouds.com

emilio-m.com

crashycraft.net

washmebro.com

1houroflife.com

millershaga.com

newtonpod.com

camopants.net

animator-show.com

qqzome.com

assetacre.com

letsmakeyourchoice.com

gileadpreferences.com

ecomarklifestyle.com

mivaautomotive.com

rattle100.com

askfortesting.com

majorelectricalwork.com

blockbotprofit.com

lanceseuexpert.online

zatventure.com

fitnessbykc.com

renatafaceandbodyskincare.com

opusmime.com

biyimeilou.com

soulhospitalitygroup.net

peaktradecapital.com

augmentedfact.com

petmall.website

rfmanutencoes.com

mgav40.xyz

konzertmanagement.com

thisisweenz.com

xn--42cg2czax6ptae6a.com

scienceworldapub.com

perfumeriavictory.com

ankarasinirsizescortlar.xyz

keenflat.com

fodfus.com

bright-tailor.com

spaciolb.com

pinkpolishseattle.com

homewebmailz.com

devple.com

cimehey9.xyz

tracks-clicks.com

Signatures 9

Filter: none

  • Xloader

    Description

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/3012-124-0x0000000000400000-0x0000000000429000-memory.dmpxloader
    behavioral2/memory/3012-125-0x000000000041D450-mapping.dmpxloader
    behavioral2/memory/500-132-0x00000000006C0000-0x00000000006E9000-memory.dmpxloader
  • Suspicious use of SetThreadContext
    GLEASON_QT2309.exeGLEASON_QT2309.exeraserver.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 808 set thread context of 3012808GLEASON_QT2309.exeGLEASON_QT2309.exe
    PID 3012 set thread context of 30523012GLEASON_QT2309.exeExplorer.EXE
    PID 500 set thread context of 3052500raserver.exeExplorer.EXE
  • Suspicious behavior: EnumeratesProcesses
    GLEASON_QT2309.exeGLEASON_QT2309.exeraserver.exe

    Reported IOCs

    pidprocess
    808GLEASON_QT2309.exe
    808GLEASON_QT2309.exe
    3012GLEASON_QT2309.exe
    3012GLEASON_QT2309.exe
    3012GLEASON_QT2309.exe
    3012GLEASON_QT2309.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
    500raserver.exe
  • Suspicious behavior: GetForegroundWindowSpam
    Explorer.EXE

    Reported IOCs

    pidprocess
    3052Explorer.EXE
  • Suspicious behavior: MapViewOfSection
    GLEASON_QT2309.exeraserver.exe

    Reported IOCs

    pidprocess
    3012GLEASON_QT2309.exe
    3012GLEASON_QT2309.exe
    3012GLEASON_QT2309.exe
    500raserver.exe
    500raserver.exe
  • Suspicious use of AdjustPrivilegeToken
    GLEASON_QT2309.exeGLEASON_QT2309.exeraserver.exeExplorer.EXE

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege808GLEASON_QT2309.exe
    Token: SeDebugPrivilege3012GLEASON_QT2309.exe
    Token: SeDebugPrivilege500raserver.exe
    Token: SeShutdownPrivilege3052Explorer.EXE
    Token: SeCreatePagefilePrivilege3052Explorer.EXE
    Token: SeShutdownPrivilege3052Explorer.EXE
    Token: SeCreatePagefilePrivilege3052Explorer.EXE
    Token: SeShutdownPrivilege3052Explorer.EXE
    Token: SeCreatePagefilePrivilege3052Explorer.EXE
  • Suspicious use of UnmapMainImage
    Explorer.EXE

    Reported IOCs

    pidprocess
    3052Explorer.EXE
  • Suspicious use of WriteProcessMemory
    GLEASON_QT2309.exeExplorer.EXEraserver.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 808 wrote to memory of 3216808GLEASON_QT2309.exeGLEASON_QT2309.exe
    PID 808 wrote to memory of 3216808GLEASON_QT2309.exeGLEASON_QT2309.exe
    PID 808 wrote to memory of 3216808GLEASON_QT2309.exeGLEASON_QT2309.exe
    PID 808 wrote to memory of 3012808GLEASON_QT2309.exeGLEASON_QT2309.exe
    PID 808 wrote to memory of 3012808GLEASON_QT2309.exeGLEASON_QT2309.exe
    PID 808 wrote to memory of 3012808GLEASON_QT2309.exeGLEASON_QT2309.exe
    PID 808 wrote to memory of 3012808GLEASON_QT2309.exeGLEASON_QT2309.exe
    PID 808 wrote to memory of 3012808GLEASON_QT2309.exeGLEASON_QT2309.exe
    PID 808 wrote to memory of 3012808GLEASON_QT2309.exeGLEASON_QT2309.exe
    PID 3052 wrote to memory of 5003052Explorer.EXEraserver.exe
    PID 3052 wrote to memory of 5003052Explorer.EXEraserver.exe
    PID 3052 wrote to memory of 5003052Explorer.EXEraserver.exe
    PID 500 wrote to memory of 584500raserver.execmd.exe
    PID 500 wrote to memory of 584500raserver.execmd.exe
    PID 500 wrote to memory of 584500raserver.execmd.exe
Processes 6
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of UnmapMainImage
    Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Users\Admin\AppData\Local\Temp\GLEASON_QT2309.exe
      "C:\Users\Admin\AppData\Local\Temp\GLEASON_QT2309.exe"
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:808
      • C:\Users\Admin\AppData\Local\Temp\GLEASON_QT2309.exe
        "C:\Users\Admin\AppData\Local\Temp\GLEASON_QT2309.exe"
        PID:3216
      • C:\Users\Admin\AppData\Local\Temp\GLEASON_QT2309.exe
        "C:\Users\Admin\AppData\Local\Temp\GLEASON_QT2309.exe"
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        PID:3012
    • C:\Windows\SysWOW64\raserver.exe
      "C:\Windows\SysWOW64\raserver.exe"
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:500
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\GLEASON_QT2309.exe"
        PID:584
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/500-129-0x0000000000000000-mapping.dmp

                          • memory/500-134-0x00000000044B0000-0x0000000004540000-memory.dmp

                          • memory/500-132-0x00000000006C0000-0x00000000006E9000-memory.dmp

                          • memory/500-131-0x0000000000B80000-0x0000000000B9F000-memory.dmp

                          • memory/500-133-0x00000000047E0000-0x0000000004B00000-memory.dmp

                          • memory/584-130-0x0000000000000000-mapping.dmp

                          • memory/808-121-0x0000000007870000-0x0000000007871000-memory.dmp

                          • memory/808-120-0x0000000005580000-0x000000000559D000-memory.dmp

                          • memory/808-123-0x0000000007B20000-0x0000000007B57000-memory.dmp

                          • memory/808-119-0x0000000005190000-0x0000000005191000-memory.dmp

                          • memory/808-114-0x00000000008F0000-0x00000000008F1000-memory.dmp

                          • memory/808-118-0x00000000051F0000-0x00000000051F1000-memory.dmp

                          • memory/808-117-0x0000000005290000-0x0000000005291000-memory.dmp

                          • memory/808-116-0x00000000056F0000-0x00000000056F1000-memory.dmp

                          • memory/808-122-0x0000000007AB0000-0x0000000007B16000-memory.dmp

                          • memory/3012-125-0x000000000041D450-mapping.dmp

                          • memory/3012-126-0x0000000001960000-0x0000000001C80000-memory.dmp

                          • memory/3012-127-0x00000000017E0000-0x00000000017F1000-memory.dmp

                          • memory/3012-124-0x0000000000400000-0x0000000000429000-memory.dmp

                          • memory/3052-128-0x0000000004C80000-0x0000000004D5D000-memory.dmp

                          • memory/3052-135-0x0000000004DA0000-0x0000000004EA0000-memory.dmp