xloader | f35e37b873cb4bee71eab9a5caa6bc7bcb592d84b7924e83ec00a5c9058eb03b

General

Target

1bbc9d68daddfbdb240d292ad00c3a50.exe
Size

778KB
MD5

1bbc9d68daddfbdb240d292ad00c3a50
SHA1

5a3a7e4891e4e24c5d3dacd58fcc6b8ccc02cda5
SHA256

f35e37b873cb4bee71eab9a5caa6bc7bcb592d84b7924e83ec00a5c9058eb03b
SHA512

a8350519a5b25b9b9dc09daccea215cf616dfb9cbd2770de9ec11fd91667e32358b6abb22d2f1451c88d3ddaa4e1a847e42dfa834f112fe60240651d330919f5

Score

10^/10

xloader utrf loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

utrf

C2

http://www.xiaohe-jiankang.com/utrf/

Decoy

poppup.store

memoria-helvetica.net

rkx6.com

god-gym.com

ninuweyr.com

icilanaudiere.com

boardabird.com

moorefamilyholdingsllc.com

sakudata.com

vluowqvc.icu

misscakehead.com

studentoflife4life.com

488prospectst.com

jugoon.xyz

privatemortgageinvest.com

leeeg.com

eventoslasperlas.com

azx2.com

pcwebdesign65656.xyz

aura-tic.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1036-60-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/1036-61-0x000000000041D030-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

1bbc9d68daddfbdb240d292ad00c3a50.exe

description pid process target process

PID 612 set thread context of 1036 612 1bbc9d68daddfbdb240d292ad00c3a50.exe 1bbc9d68daddfbdb240d292ad00c3a50.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1bbc9d68daddfbdb240d292ad00c3a50.exepowershell.exe

pid process

1036 1bbc9d68daddfbdb240d292ad00c3a50.exe
1800 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1800 powershell.exe

description	pid	process	target process
PID 612 set thread context of 1036	612	1bbc9d68daddfbdb240d292ad00c3a50.exe	1bbc9d68daddfbdb240d292ad00c3a50.exe

pid	process
1036	1bbc9d68daddfbdb240d292ad00c3a50.exe
1800	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1800	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

1bbc9d68daddfbdb240d292ad00c3a50.exe

description	pid	process	target process
PID 612 wrote to memory of 1800	612	1bbc9d68daddfbdb240d292ad00c3a50.exe	powershell.exe
PID 612 wrote to memory of 1800	612	1bbc9d68daddfbdb240d292ad00c3a50.exe	powershell.exe
PID 612 wrote to memory of 1800	612	1bbc9d68daddfbdb240d292ad00c3a50.exe	powershell.exe
PID 612 wrote to memory of 1800	612	1bbc9d68daddfbdb240d292ad00c3a50.exe	powershell.exe
PID 612 wrote to memory of 1036	612	1bbc9d68daddfbdb240d292ad00c3a50.exe	1bbc9d68daddfbdb240d292ad00c3a50.exe
PID 612 wrote to memory of 1036	612	1bbc9d68daddfbdb240d292ad00c3a50.exe	1bbc9d68daddfbdb240d292ad00c3a50.exe
PID 612 wrote to memory of 1036	612	1bbc9d68daddfbdb240d292ad00c3a50.exe	1bbc9d68daddfbdb240d292ad00c3a50.exe
PID 612 wrote to memory of 1036	612	1bbc9d68daddfbdb240d292ad00c3a50.exe	1bbc9d68daddfbdb240d292ad00c3a50.exe
PID 612 wrote to memory of 1036	612	1bbc9d68daddfbdb240d292ad00c3a50.exe	1bbc9d68daddfbdb240d292ad00c3a50.exe
PID 612 wrote to memory of 1036	612	1bbc9d68daddfbdb240d292ad00c3a50.exe	1bbc9d68daddfbdb240d292ad00c3a50.exe
PID 612 wrote to memory of 1036	612	1bbc9d68daddfbdb240d292ad00c3a50.exe	1bbc9d68daddfbdb240d292ad00c3a50.exe

C:\Users\Admin\AppData\Local\Temp\1bbc9d68daddfbdb240d292ad00c3a50.exe
"C:\Users\Admin\AppData\Local\Temp\1bbc9d68daddfbdb240d292ad00c3a50.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:612

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1bbc9d68daddfbdb240d292ad00c3a50.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Users\Admin\AppData\Local\Temp\1bbc9d68daddfbdb240d292ad00c3a50.exe
"C:\Users\Admin\AppData\Local\Temp\1bbc9d68daddfbdb240d292ad00c3a50.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1036

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/612-53-0x00000000009F0000-0x00000000009F1000-memory.dmp

Filesize
4KB

Download
memory/612-55-0x0000000000590000-0x00000000005AD000-memory.dmp

Filesize
116KB

Download
memory/612-56-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/612-57-0x0000000004FF0000-0x0000000005055000-memory.dmp

Filesize
404KB

Download
memory/612-58-0x0000000002170000-0x00000000021A5000-memory.dmp

Filesize
212KB

Download
memory/1036-60-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1036-61-0x000000000041D030-mapping.dmp

Download
memory/1036-64-0x0000000000AC0000-0x0000000000DC3000-memory.dmp

Filesize
3.0MB

Download
memory/1800-59-0x0000000000000000-mapping.dmp

Download
memory/1800-62-0x0000000075651000-0x0000000075653000-memory.dmp

Filesize
8KB

Download
memory/1800-63-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/1800-65-0x0000000002371000-0x0000000002372000-memory.dmp

Filesize
4KB

Download
memory/1800-66-0x0000000002372000-0x0000000002374000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing