xloader | a16f2d423430943200368f83b9a96afc304d51d94e04559a456491632948799d

General

Target

ORDER OCT 14,2021.exe
Size

455KB
MD5

ca68a998d9ed33841178fd898456fa70
SHA1

5bf8490907f77aee7999ac5826a648ac2aaf4a64
SHA256

a16f2d423430943200368f83b9a96afc304d51d94e04559a456491632948799d
SHA512

a2e520583dc489897db757ff113df161e0110e48122f0a5730c742dbd415f454f35dfa458016853268a0e7e0f11cc13a2490249c7a130e53bec34aa999239d6c

Score

10^/10

xloader b2c0 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4036-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/4036-117-0x000000000041D4C0-mapping.dmp	xloader
behavioral2/memory/3580-124-0x0000000002D10000-0x0000000002D39000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

ORDER OCT 14,2021.exe

pid process

2072 ORDER OCT 14,2021.exe

pid	process
2072	ORDER OCT 14,2021.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

ORDER OCT 14,2021.exeORDER OCT 14,2021.exeraserver.exe

description	pid	process	target process
PID 2072 set thread context of 4036	2072	ORDER OCT 14,2021.exe	ORDER OCT 14,2021.exe
PID 4036 set thread context of 3068	4036	ORDER OCT 14,2021.exe	Explorer.EXE
PID 3580 set thread context of 3068	3580	raserver.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

ORDER OCT 14,2021.exeraserver.exe

pid	process
4036	ORDER OCT 14,2021.exe
4036	ORDER OCT 14,2021.exe
4036	ORDER OCT 14,2021.exe
4036	ORDER OCT 14,2021.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe
3580	raserver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3068 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

ORDER OCT 14,2021.exeraserver.exe

pid process

4036 ORDER OCT 14,2021.exe
4036 ORDER OCT 14,2021.exe
4036 ORDER OCT 14,2021.exe
3580 raserver.exe
3580 raserver.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ORDER OCT 14,2021.exeraserver.exe

description pid process

Token: SeDebugPrivilege 4036 ORDER OCT 14,2021.exe
Token: SeDebugPrivilege 3580 raserver.exe

pid	process
3068	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	4036	ORDER OCT 14,2021.exe
Token: SeDebugPrivilege	3580	raserver.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ORDER OCT 14,2021.exeExplorer.EXEraserver.exe

description	pid	process	target process
PID 2072 wrote to memory of 4036	2072	ORDER OCT 14,2021.exe	ORDER OCT 14,2021.exe
PID 2072 wrote to memory of 4036	2072	ORDER OCT 14,2021.exe	ORDER OCT 14,2021.exe
PID 2072 wrote to memory of 4036	2072	ORDER OCT 14,2021.exe	ORDER OCT 14,2021.exe
PID 2072 wrote to memory of 4036	2072	ORDER OCT 14,2021.exe	ORDER OCT 14,2021.exe
PID 2072 wrote to memory of 4036	2072	ORDER OCT 14,2021.exe	ORDER OCT 14,2021.exe
PID 2072 wrote to memory of 4036	2072	ORDER OCT 14,2021.exe	ORDER OCT 14,2021.exe
PID 3068 wrote to memory of 3580	3068	Explorer.EXE	raserver.exe
PID 3068 wrote to memory of 3580	3068	Explorer.EXE	raserver.exe
PID 3068 wrote to memory of 3580	3068	Explorer.EXE	raserver.exe
PID 3580 wrote to memory of 2248	3580	raserver.exe	cmd.exe
PID 3580 wrote to memory of 2248	3580	raserver.exe	cmd.exe
PID 3580 wrote to memory of 2248	3580	raserver.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3068

C:\Users\Admin\AppData\Local\Temp\ORDER OCT 14,2021.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER OCT 14,2021.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2072

C:\Users\Admin\AppData\Local\Temp\ORDER OCT 14,2021.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER OCT 14,2021.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4036

C:\Windows\SysWOW64\raserver.exe
"C:\Windows\SysWOW64\raserver.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3580

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\ORDER OCT 14,2021.exe"
3⤵
PID:2248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsn9712.tmp\vimwjoytbc.dll
MD5
59d48d07a4dff9490eb5080e52b3fef5

SHA1
6d7c3b754b744554e9397efd4c2529455abbddd7

SHA256
63a1932abbb4a08a4c7e1d250433598fdf71f50be2686c9f4a420b57c9239f38

SHA512
c58555e0a3fe97bfad6909d1ce7ecfafdca13c0936ca12adfb67cc9707a629c15bb617e03c32adcbad299d8c35a7def50003b0159cb73155b4d53c9edb2df8b0

Download Submit
memory/2248-125-0x0000000000000000-mapping.dmp

Download
memory/3068-121-0x0000000000CD0000-0x0000000000D7D000-memory.dmp

Filesize
692KB

Download
memory/3068-128-0x0000000006790000-0x00000000068C9000-memory.dmp

Filesize
1.2MB

Download
memory/3580-122-0x0000000000000000-mapping.dmp

Download
memory/3580-124-0x0000000002D10000-0x0000000002D39000-memory.dmp

Filesize
164KB

Download
memory/3580-123-0x0000000000200000-0x000000000021F000-memory.dmp

Filesize
124KB

Download
memory/3580-126-0x0000000004660000-0x0000000004980000-memory.dmp

Filesize
3.1MB

Download
memory/3580-127-0x0000000004550000-0x00000000045E0000-memory.dmp

Filesize
576KB

Download
memory/4036-120-0x0000000000D10000-0x0000000000D21000-memory.dmp

Filesize
68KB

Download
memory/4036-119-0x00000000009D0000-0x0000000000CF0000-memory.dmp

Filesize
3.1MB

Download
memory/4036-117-0x000000000041D4C0-mapping.dmp

Download
memory/4036-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads