xloader | 144fc8c1a922dbb8162d72a94780f8559bbd9e6b1faa9e037fd33e809126b080

General

Target
PO-003785GMHN.exe
Size 985KB
Sample210927-txj8jshecq
SHA256 144fc8c1a922dbb8162d72a94780f8559bbd9e6b1faa9e037fd33e809126b080
MD5 4577c41fc896a87df4513f13d29ee65a
SHA1 38e76942a779e8b04cdf763cf993ceda76d049f2
SHA512 dbd15ae87202593f80daf6563bd7ef8bb9be154c7c1995ca6c127c7bfa8e8fb1eb5d9c075d887ef8a893fa64ddb72402e11da3c7f57aeda276ee4fc3c50f21af
MD5 SHA1 SHA512

Score

10^/10

xloader 8iwd loader persistence rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

8iwd

C2

http://www.serpascarnes.com/8iwd/

Decoy

openhousedigitale.com
helpindia.store
josiahspicer.com
wydancer.com
athinatoday.com
asiapartnerspoint.com
freemakechefsrecipes.com
metrolistingsservices.com
assarytagged.quest
ververevival.com
cjdue.com
iqmetaverse.com
sh-spgdk.com
spacecitybeauty.com
phasmatoidea.com
yz1866.com
tenlog009.xyz
gameprizes.xyz
415know.com
virus-jestock.com
fmsgmbh.com
chinaglobalawarenesscodeday.com
sekailuxe.com
luvjoyproperties.com
amandlaparaffin.com
dreamcenterabq.com
finestpoints.com
lbbed.com
teamgamecocks.club
fallscreation.com
365gy.net
vtprealtor.com
emailassure.com
yogiler.com
ss2196.com
csntow.com
lechotamalamona.com
kingdomofdavid.kiwi
ismaella.com
facebooking.club
adelinesgrill.com
uzh.biz
vivimendes.com
throwpillowco.com
honestwealthbuilding.com
inoutinsurance.xyz
iqvisory.com
mkbau-quickborn.com
sellbesty.com
south1995officiel.com
austrahe.com
trancendentalastroshop.store
gotcookies.net
meglutenfree.com
clayexoticsatl.com
tonerventes.com
torresflooringdecorllc.com
mentication.com
formula-evolution.com
likethespirit.com
reddysinfotech.com
laketappsapartment.com
yimailg.com
0kscp.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/4092-117-0x0000000000000000-mapping.dmp	xloader
behavioral2/memory/4092-126-0x0000000050480000-0x00000000504A9000-memory.dmp	xloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Udffvxu = "C:\\Users\\Public\\Libraries\\uxvffdU.url"	PO-003785GMHN.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4356	4092	WerFault.exe	70

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
4544	reg.exe
4624	reg.exe
3148	reg.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe
4356	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4356	WerFault.exe
Token: SeBackupPrivilege	4356	WerFault.exe
Token: SeDebugPrivilege	4356	WerFault.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 4092	3644	PO-003785GMHN.exe	70
PID 3644 wrote to memory of 4092	3644	PO-003785GMHN.exe	70
PID 3644 wrote to memory of 4092	3644	PO-003785GMHN.exe	70
PID 3644 wrote to memory of 4092	3644	PO-003785GMHN.exe	70
PID 3644 wrote to memory of 4092	3644	PO-003785GMHN.exe	70
PID 3644 wrote to memory of 4092	3644	PO-003785GMHN.exe	70
PID 3644 wrote to memory of 3552	3644	PO-003785GMHN.exe	71
PID 3644 wrote to memory of 3552	3644	PO-003785GMHN.exe	71
PID 3644 wrote to memory of 3552	3644	PO-003785GMHN.exe	71
PID 3552 wrote to memory of 4344	3552	cmd.exe	74
PID 3552 wrote to memory of 4344	3552	cmd.exe	74
PID 3552 wrote to memory of 4344	3552	cmd.exe	74
PID 4344 wrote to memory of 4544	4344	cmd.exe	77
PID 4344 wrote to memory of 4544	4344	cmd.exe	77
PID 4344 wrote to memory of 4544	4344	cmd.exe	77
PID 4344 wrote to memory of 4624	4344	cmd.exe	78
PID 4344 wrote to memory of 4624	4344	cmd.exe	78
PID 4344 wrote to memory of 4624	4344	cmd.exe	78
PID 4344 wrote to memory of 4604	4344	cmd.exe	79
PID 4344 wrote to memory of 4604	4344	cmd.exe	79
PID 4344 wrote to memory of 4604	4344	cmd.exe	79
PID 3644 wrote to memory of 732	3644	PO-003785GMHN.exe	80
PID 3644 wrote to memory of 732	3644	PO-003785GMHN.exe	80
PID 3644 wrote to memory of 732	3644	PO-003785GMHN.exe	80
PID 732 wrote to memory of 3148	732	cmd.exe	82
PID 732 wrote to memory of 3148	732	cmd.exe	82
PID 732 wrote to memory of 3148	732	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\PO-003785GMHN.exe
"C:\Users\Admin\AppData\Local\Temp\PO-003785GMHN.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Windows\SysWOW64\mobsync.exe
  "C:\Windows\System32\mobsync.exe"
  2⤵
  PID:4092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 468
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Windows\SysWOW64\reg.exe
      reg delete hkcu\Environment /v windir /f
      4⤵
      Modifies registry key
      PID:4544
  - - C:\Windows\SysWOW64\reg.exe
      reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      4⤵
      Modifies registry key
      PID:4624
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      4⤵
      PID:4604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:732
- - C:\Windows\SysWOW64\reg.exe
    reg delete hkcu\Environment /v windir /f
    3⤵
    - Modifies registry key
    PID:3148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3644-116-0x00000000006B0000-0x00000000006B1000-memory.dmp

Download

memory/4092-126-0x0000000050480000-0x00000000504A9000-memory.dmp

Download

memory/4092-125-0x0000000002550000-0x0000000002551000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads