xloader | a16f2d423430943200368f83b9a96afc304d51d94e04559a456491632948799d

General

Target

ORDER OCT 14,2021.exe
Size

455KB
MD5

ca68a998d9ed33841178fd898456fa70
SHA1

5bf8490907f77aee7999ac5826a648ac2aaf4a64
SHA256

a16f2d423430943200368f83b9a96afc304d51d94e04559a456491632948799d
SHA512

a2e520583dc489897db757ff113df161e0110e48122f0a5730c742dbd415f454f35dfa458016853268a0e7e0f11cc13a2490249c7a130e53bec34aa999239d6c

Score

10^/10

xloader b2c0 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1252-62-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1252-63-0x000000000041D4C0-mapping.dmp	xloader
behavioral1/memory/572-71-0x00000000000C0000-0x00000000000E9000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1812 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

ORDER OCT 14,2021.exe

pid process

2024 ORDER OCT 14,2021.exe

pid	process
1812	cmd.exe

pid	process
2024	ORDER OCT 14,2021.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

ORDER OCT 14,2021.exeORDER OCT 14,2021.exeraserver.exe

description	pid	process	target process
PID 2024 set thread context of 1252	2024	ORDER OCT 14,2021.exe	ORDER OCT 14,2021.exe
PID 1252 set thread context of 1276	1252	ORDER OCT 14,2021.exe	Explorer.EXE
PID 572 set thread context of 1276	572	raserver.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

ORDER OCT 14,2021.exeraserver.exe

pid	process
1252	ORDER OCT 14,2021.exe
1252	ORDER OCT 14,2021.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe
572	raserver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

ORDER OCT 14,2021.exeraserver.exe

pid process

1252 ORDER OCT 14,2021.exe
1252 ORDER OCT 14,2021.exe
1252 ORDER OCT 14,2021.exe
572 raserver.exe
572 raserver.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ORDER OCT 14,2021.exeraserver.exe

description pid process

Token: SeDebugPrivilege 1252 ORDER OCT 14,2021.exe
Token: SeDebugPrivilege 572 raserver.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE
1276 Explorer.EXE
1276 Explorer.EXE
1276 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE
1276 Explorer.EXE
1276 Explorer.EXE
1276 Explorer.EXE

pid	process
1276	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1252	ORDER OCT 14,2021.exe
Token: SeDebugPrivilege	572	raserver.exe

pid	process
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE

pid	process
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

ORDER OCT 14,2021.exeExplorer.EXEraserver.exe

description	pid	process	target process
PID 2024 wrote to memory of 1252	2024	ORDER OCT 14,2021.exe	ORDER OCT 14,2021.exe
PID 2024 wrote to memory of 1252	2024	ORDER OCT 14,2021.exe	ORDER OCT 14,2021.exe
PID 2024 wrote to memory of 1252	2024	ORDER OCT 14,2021.exe	ORDER OCT 14,2021.exe
PID 2024 wrote to memory of 1252	2024	ORDER OCT 14,2021.exe	ORDER OCT 14,2021.exe
PID 2024 wrote to memory of 1252	2024	ORDER OCT 14,2021.exe	ORDER OCT 14,2021.exe
PID 2024 wrote to memory of 1252	2024	ORDER OCT 14,2021.exe	ORDER OCT 14,2021.exe
PID 2024 wrote to memory of 1252	2024	ORDER OCT 14,2021.exe	ORDER OCT 14,2021.exe
PID 1276 wrote to memory of 572	1276	Explorer.EXE	raserver.exe
PID 1276 wrote to memory of 572	1276	Explorer.EXE	raserver.exe
PID 1276 wrote to memory of 572	1276	Explorer.EXE	raserver.exe
PID 1276 wrote to memory of 572	1276	Explorer.EXE	raserver.exe
PID 572 wrote to memory of 1812	572	raserver.exe	cmd.exe
PID 572 wrote to memory of 1812	572	raserver.exe	cmd.exe
PID 572 wrote to memory of 1812	572	raserver.exe	cmd.exe
PID 572 wrote to memory of 1812	572	raserver.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276

C:\Users\Admin\AppData\Local\Temp\ORDER OCT 14,2021.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER OCT 14,2021.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2024

C:\Users\Admin\AppData\Local\Temp\ORDER OCT 14,2021.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER OCT 14,2021.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Windows\SysWOW64\raserver.exe
"C:\Windows\SysWOW64\raserver.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\ORDER OCT 14,2021.exe"
3⤵
- Deletes itself
PID:1812

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsxF3B2.tmp\vimwjoytbc.dll
MD5
59d48d07a4dff9490eb5080e52b3fef5

SHA1
6d7c3b754b744554e9397efd4c2529455abbddd7

SHA256
63a1932abbb4a08a4c7e1d250433598fdf71f50be2686c9f4a420b57c9239f38

SHA512
c58555e0a3fe97bfad6909d1ce7ecfafdca13c0936ca12adfb67cc9707a629c15bb617e03c32adcbad299d8c35a7def50003b0159cb73155b4d53c9edb2df8b0

Download Submit
memory/572-68-0x0000000000000000-mapping.dmp

Download
memory/572-74-0x00000000008E0000-0x0000000000970000-memory.dmp

Filesize
576KB

Download
memory/572-73-0x0000000002000000-0x0000000002303000-memory.dmp

Filesize
3.0MB

Download
memory/572-71-0x00000000000C0000-0x00000000000E9000-memory.dmp

Filesize
164KB

Download
memory/572-70-0x0000000000BE0000-0x0000000000BFC000-memory.dmp

Filesize
112KB

Download
memory/1252-63-0x000000000041D4C0-mapping.dmp

Download
memory/1252-66-0x0000000000260000-0x0000000000271000-memory.dmp

Filesize
68KB

Download
memory/1252-65-0x0000000000700000-0x0000000000A03000-memory.dmp

Filesize
3.0MB

Download
memory/1252-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1276-67-0x0000000003C00000-0x0000000003CB9000-memory.dmp

Filesize
740KB

Download
memory/1276-75-0x0000000004B10000-0x0000000004C9A000-memory.dmp

Filesize
1.5MB

Download
memory/1812-72-0x0000000000000000-mapping.dmp

Download
memory/2024-60-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads