xloader | b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be

General

Target

4.exe
Size

603KB
MD5

f8ba5db8bad75222081bc6b9297126a4
SHA1

290a186a9869a6f3ded1049b1d567eafe0041f5d
SHA256

b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be
SHA512

70f90c213dfd898c3f9e91bb6855493ab894604f04ced9b910c3f37eb1bbe658b6944cc847e315d7fe9d793bf1dba8772c38ef12fbf3cf41c52fcde3adca26d5

Score

10^/10

xloader b2c0 loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1104-56-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1104-57-0x000000000041D4C0-mapping.dmp	xloader
behavioral1/memory/284-64-0x0000000000090000-0x00000000000B9000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1248 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

4.exe

pid process

1268 4.exe

pid	process
1248	cmd.exe

pid	process
1268	4.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

4.exe4.exewuapp.exe

description	pid	process	target process
PID 1268 set thread context of 1104	1268	4.exe	4.exe
PID 1104 set thread context of 1400	1104	4.exe	Explorer.EXE
PID 284 set thread context of 1400	284	wuapp.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

4.exewuapp.exe

pid	process
1104	4.exe
1104	4.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe
284	wuapp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

4.exewuapp.exe

pid process

1104 4.exe
1104 4.exe
1104 4.exe
284 wuapp.exe
284 wuapp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4.exewuapp.exe

description pid process

Token: SeDebugPrivilege 1104 4.exe
Token: SeDebugPrivilege 284 wuapp.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE
1400 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE
1400 Explorer.EXE

pid	process
1400	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1104	4.exe
Token: SeDebugPrivilege	284	wuapp.exe

pid	process
1400	Explorer.EXE
1400	Explorer.EXE

pid	process
1400	Explorer.EXE
1400	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

4.exeExplorer.EXEwuapp.exe

description	pid	process	target process
PID 1268 wrote to memory of 1104	1268	4.exe	4.exe
PID 1268 wrote to memory of 1104	1268	4.exe	4.exe
PID 1268 wrote to memory of 1104	1268	4.exe	4.exe
PID 1268 wrote to memory of 1104	1268	4.exe	4.exe
PID 1268 wrote to memory of 1104	1268	4.exe	4.exe
PID 1268 wrote to memory of 1104	1268	4.exe	4.exe
PID 1268 wrote to memory of 1104	1268	4.exe	4.exe
PID 1400 wrote to memory of 284	1400	Explorer.EXE	wuapp.exe
PID 1400 wrote to memory of 284	1400	Explorer.EXE	wuapp.exe
PID 1400 wrote to memory of 284	1400	Explorer.EXE	wuapp.exe
PID 1400 wrote to memory of 284	1400	Explorer.EXE	wuapp.exe
PID 1400 wrote to memory of 284	1400	Explorer.EXE	wuapp.exe
PID 1400 wrote to memory of 284	1400	Explorer.EXE	wuapp.exe
PID 1400 wrote to memory of 284	1400	Explorer.EXE	wuapp.exe
PID 284 wrote to memory of 1248	284	wuapp.exe	cmd.exe
PID 284 wrote to memory of 1248	284	wuapp.exe	cmd.exe
PID 284 wrote to memory of 1248	284	wuapp.exe	cmd.exe
PID 284 wrote to memory of 1248	284	wuapp.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400

C:\Users\Admin\AppData\Local\Temp\4.exe
"C:\Users\Admin\AppData\Local\Temp\4.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1268

C:\Users\Admin\AppData\Local\Temp\4.exe
"C:\Users\Admin\AppData\Local\Temp\4.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:468

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:872

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:1148

C:\Windows\SysWOW64\wuapp.exe
"C:\Windows\SysWOW64\wuapp.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:284

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\4.exe"
3⤵
- Deletes itself
PID:1248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsiEE17.tmp\fqbakxndgg.dll
MD5
0ec0b6676a0c830fa1d12a82e0e2ccfc

SHA1
61edae0d4bb19dd31b9ed2ed4d76c99b4f04ebe2

SHA256
c168119aced865f94f0856f3d7419f33142ffe0e8f90c94205d5707b60710617

SHA512
ea5496d61a19ac03a49788d5cc7ae18603ec728c153b9c580f6faa7cfc850c297f9978429627e765467d8130409ca25ce041f0f42065d14fe53c6ef69943e574

Download Submit
memory/284-62-0x0000000000000000-mapping.dmp

Download
memory/284-67-0x0000000000910000-0x00000000009A0000-memory.dmp

Filesize
576KB

Download
memory/284-65-0x0000000000B50000-0x0000000000E53000-memory.dmp

Filesize
3.0MB

Download
memory/284-64-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/284-63-0x0000000001260000-0x000000000126B000-memory.dmp

Filesize
44KB

Download
memory/1104-57-0x000000000041D4C0-mapping.dmp

Download
memory/1104-59-0x0000000000900000-0x0000000000C03000-memory.dmp

Filesize
3.0MB

Download
memory/1104-60-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1104-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1248-66-0x0000000000000000-mapping.dmp

Download
memory/1268-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1400-61-0x0000000006A40000-0x0000000006B96000-memory.dmp

Filesize
1.3MB

Download
memory/1400-68-0x0000000008B10000-0x0000000008BD5000-memory.dmp

Filesize
788KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads