xloader | dae6ba220bb0a34de731b57965753391343bfe96f9f3fa4fea48102d3377ccf7

General

Target

PRICE_REQUEST_QUOTATION.exe
Size

260KB
MD5

85589170af713a03ca622f94429c634a
SHA1

4e0b9dfd13dd6e4b85bca4352be0cec2be9024d7
SHA256

dae6ba220bb0a34de731b57965753391343bfe96f9f3fa4fea48102d3377ccf7
SHA512

1379d1dbed880c664d7314018e676970afd192a423e6144f3bac6b15e5f89fb4bc245adbe462046ccfb6692e0054be18b459bc2757e60d700c03758232682dd9

Score

10^/10

xloader rgoe loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

rgoe

C2

http://www.nudesalon.digital/rgoe/

Decoy

iamstevekelsey.com

homesofchaparralcountryclub.com

voiceyupcom.com

searchengineeye.com

charsantosart.com

baila.madrid

yota.store

halloweenbaldhills.net

futurodr.com

centercodebase.com

666b20.xyz

4-6-2.com

gspotworld.com

rbb78.com

1kingbet.com

hzhongon.com

dossierinc.com

sustainablefoodfactory.com

golfsol.art

socialenterprisestudio.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1488-55-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1488-56-0x000000000041D470-mapping.dmp	xloader
behavioral1/memory/1716-64-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

788 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

PRICE_REQUEST_QUOTATION.exe

pid process

1544 PRICE_REQUEST_QUOTATION.exe

pid	process
788	cmd.exe

pid	process
1544	PRICE_REQUEST_QUOTATION.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

PRICE_REQUEST_QUOTATION.exePRICE_REQUEST_QUOTATION.exesystray.exe

description	pid	process	target process
PID 1544 set thread context of 1488	1544	PRICE_REQUEST_QUOTATION.exe	PRICE_REQUEST_QUOTATION.exe
PID 1488 set thread context of 1376	1488	PRICE_REQUEST_QUOTATION.exe	Explorer.EXE
PID 1488 set thread context of 1376	1488	PRICE_REQUEST_QUOTATION.exe	Explorer.EXE
PID 1716 set thread context of 1376	1716	systray.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

PRICE_REQUEST_QUOTATION.exesystray.exe

pid	process
1488	PRICE_REQUEST_QUOTATION.exe
1488	PRICE_REQUEST_QUOTATION.exe
1488	PRICE_REQUEST_QUOTATION.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe
1716	systray.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1376 Explorer.EXE

pid	process
1376	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

PRICE_REQUEST_QUOTATION.exesystray.exe

pid	process
1488	PRICE_REQUEST_QUOTATION.exe
1488	PRICE_REQUEST_QUOTATION.exe
1488	PRICE_REQUEST_QUOTATION.exe
1488	PRICE_REQUEST_QUOTATION.exe
1716	systray.exe
1716	systray.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PRICE_REQUEST_QUOTATION.exesystray.exe

description pid process

Token: SeDebugPrivilege 1488 PRICE_REQUEST_QUOTATION.exe
Token: SeDebugPrivilege 1716 systray.exe
Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

Explorer.EXE

pid process

1376 Explorer.EXE
1376 Explorer.EXE
1376 Explorer.EXE
1376 Explorer.EXE
1376 Explorer.EXE
1376 Explorer.EXE
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

Explorer.EXE

pid process

1376 Explorer.EXE
1376 Explorer.EXE
1376 Explorer.EXE
1376 Explorer.EXE
1376 Explorer.EXE
1376 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1488	PRICE_REQUEST_QUOTATION.exe
Token: SeDebugPrivilege	1716	systray.exe

pid	process
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE

pid	process
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE
1376	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

PRICE_REQUEST_QUOTATION.exeExplorer.EXEsystray.exe

description	pid	process	target process
PID 1544 wrote to memory of 1488	1544	PRICE_REQUEST_QUOTATION.exe	PRICE_REQUEST_QUOTATION.exe
PID 1544 wrote to memory of 1488	1544	PRICE_REQUEST_QUOTATION.exe	PRICE_REQUEST_QUOTATION.exe
PID 1544 wrote to memory of 1488	1544	PRICE_REQUEST_QUOTATION.exe	PRICE_REQUEST_QUOTATION.exe
PID 1544 wrote to memory of 1488	1544	PRICE_REQUEST_QUOTATION.exe	PRICE_REQUEST_QUOTATION.exe
PID 1544 wrote to memory of 1488	1544	PRICE_REQUEST_QUOTATION.exe	PRICE_REQUEST_QUOTATION.exe
PID 1544 wrote to memory of 1488	1544	PRICE_REQUEST_QUOTATION.exe	PRICE_REQUEST_QUOTATION.exe
PID 1544 wrote to memory of 1488	1544	PRICE_REQUEST_QUOTATION.exe	PRICE_REQUEST_QUOTATION.exe
PID 1376 wrote to memory of 1716	1376	Explorer.EXE	systray.exe
PID 1376 wrote to memory of 1716	1376	Explorer.EXE	systray.exe
PID 1376 wrote to memory of 1716	1376	Explorer.EXE	systray.exe
PID 1376 wrote to memory of 1716	1376	Explorer.EXE	systray.exe
PID 1716 wrote to memory of 788	1716	systray.exe	cmd.exe
PID 1716 wrote to memory of 788	1716	systray.exe	cmd.exe
PID 1716 wrote to memory of 788	1716	systray.exe	cmd.exe
PID 1716 wrote to memory of 788	1716	systray.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1376

C:\Users\Admin\AppData\Local\Temp\PRICE_REQUEST_QUOTATION.exe
"C:\Users\Admin\AppData\Local\Temp\PRICE_REQUEST_QUOTATION.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1544

C:\Users\Admin\AppData\Local\Temp\PRICE_REQUEST_QUOTATION.exe
"C:\Users\Admin\AppData\Local\Temp\PRICE_REQUEST_QUOTATION.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1488

C:\Windows\SysWOW64\systray.exe
"C:\Windows\SysWOW64\systray.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\PRICE_REQUEST_QUOTATION.exe"
3⤵
- Deletes itself
PID:788

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsvAD20.tmp\akepwc.dll
MD5
0560ba80e8afe7f5d83eb600602ab426

SHA1
a783f03bc76ee70833d61d69d854674f45d5a223

SHA256
19013d7428a659774231fd4b5213a463eeab58a0c347dadfaa95536bd89d3f13

SHA512
a034974dc569db8064b9bc5699e33b188c581e716862fed95708a1b2caaccaa6ae8ee4f4f23989c68ef838ea71271423501b6aea27a9c216af9db9745356b12c

Download Submit
memory/788-65-0x0000000000000000-mapping.dmp

Download
memory/1376-61-0x0000000004F90000-0x00000000050AD000-memory.dmp

Filesize
1.1MB

Download
memory/1376-59-0x0000000004900000-0x0000000004A2F000-memory.dmp

Filesize
1.2MB

Download
memory/1376-68-0x00000000068C0000-0x0000000006A00000-memory.dmp

Filesize
1.2MB

Download
memory/1488-55-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1488-58-0x0000000000350000-0x0000000000361000-memory.dmp

Filesize
68KB

Download
memory/1488-60-0x0000000000390000-0x00000000003A1000-memory.dmp

Filesize
68KB

Download
memory/1488-56-0x000000000041D470-mapping.dmp

Download
memory/1488-57-0x0000000000910000-0x0000000000C13000-memory.dmp

Filesize
3.0MB

Download
memory/1544-53-0x0000000074B91000-0x0000000074B93000-memory.dmp

Filesize
8KB

Download
memory/1716-62-0x0000000000000000-mapping.dmp

Download
memory/1716-63-0x0000000000870000-0x0000000000875000-memory.dmp

Filesize
20KB

Download
memory/1716-64-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/1716-66-0x0000000001F50000-0x0000000002253000-memory.dmp

Filesize
3.0MB

Download
memory/1716-67-0x0000000001D20000-0x0000000001DB0000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads