xloader | 1bbc8a34b7590c1593c5a79a8d0f93b17a162f44893c37aa11e4cb9e0e2d96bf

General

Target

Unpaid invoice.exe
Size

450KB
MD5

98d2d5ac3bd493d77f0a7300a43d045b
SHA1

7fdd3b9b76f2c40df10def7ec3aa25c4fb192ec7
SHA256

1bbc8a34b7590c1593c5a79a8d0f93b17a162f44893c37aa11e4cb9e0e2d96bf
SHA512

32b7aa0518d6b41864d0f6f90d397cd377244b8f6af07178252aeb5b7ecf57e347c2aa2a3a4d94327d799bfcf8fe87b5c8164b0102c64258fd55a4c024ad0ef3

Score

10^/10

xloader b2c0 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4232-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/4232-117-0x000000000041D4C0-mapping.dmp	xloader
behavioral2/memory/1960-124-0x0000000003300000-0x0000000003329000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

Unpaid invoice.exe

pid process

3524 Unpaid invoice.exe

pid	process
3524	Unpaid invoice.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Unpaid invoice.exeUnpaid invoice.exewscript.exe

description	pid	process	target process
PID 3524 set thread context of 4232	3524	Unpaid invoice.exe	Unpaid invoice.exe
PID 4232 set thread context of 3044	4232	Unpaid invoice.exe	Explorer.EXE
PID 1960 set thread context of 3044	1960	wscript.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 62 IoCs

Processes:

Unpaid invoice.exewscript.exe

pid	process
4232	Unpaid invoice.exe
4232	Unpaid invoice.exe
4232	Unpaid invoice.exe
4232	Unpaid invoice.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe
1960	wscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3044 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Unpaid invoice.exewscript.exe

pid process

4232 Unpaid invoice.exe
4232 Unpaid invoice.exe
4232 Unpaid invoice.exe
1960 wscript.exe
1960 wscript.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Unpaid invoice.exewscript.exe

description pid process

Token: SeDebugPrivilege 4232 Unpaid invoice.exe
Token: SeDebugPrivilege 1960 wscript.exe

pid	process
3044	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	4232	Unpaid invoice.exe
Token: SeDebugPrivilege	1960	wscript.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Unpaid invoice.exeExplorer.EXEwscript.exe

description	pid	process	target process
PID 3524 wrote to memory of 4232	3524	Unpaid invoice.exe	Unpaid invoice.exe
PID 3524 wrote to memory of 4232	3524	Unpaid invoice.exe	Unpaid invoice.exe
PID 3524 wrote to memory of 4232	3524	Unpaid invoice.exe	Unpaid invoice.exe
PID 3524 wrote to memory of 4232	3524	Unpaid invoice.exe	Unpaid invoice.exe
PID 3524 wrote to memory of 4232	3524	Unpaid invoice.exe	Unpaid invoice.exe
PID 3524 wrote to memory of 4232	3524	Unpaid invoice.exe	Unpaid invoice.exe
PID 3044 wrote to memory of 1960	3044	Explorer.EXE	wscript.exe
PID 3044 wrote to memory of 1960	3044	Explorer.EXE	wscript.exe
PID 3044 wrote to memory of 1960	3044	Explorer.EXE	wscript.exe
PID 1960 wrote to memory of 4272	1960	wscript.exe	cmd.exe
PID 1960 wrote to memory of 4272	1960	wscript.exe	cmd.exe
PID 1960 wrote to memory of 4272	1960	wscript.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3044

C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3524

C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\SysWOW64\wscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe"
3⤵
PID:4272

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsrE0EC.tmp\gyalquzbu.dll
MD5
a8caa6d267951ad22e835233b5e50c46

SHA1
45c722c5958d99727a95d30eaa3032203d1f4ab2

SHA256
db7b70b0734285b8d9a1f3617e55603b0cb649d9bf0b7fbf8988c44e684f4e76

SHA512
9ee74bf576554210f8923dda8aa28f6dc7f3c5aa52da7b48a94beaf56cb4e27f1c3d0387cc9116e467631bc13c0e743341129bffa84b9db16ace1248a53b4cd7

Download Submit
memory/1960-125-0x00000000049B0000-0x0000000004CD0000-memory.dmp

Filesize
3.1MB

Download
memory/1960-122-0x0000000000000000-mapping.dmp

Download
memory/1960-123-0x0000000000B60000-0x0000000000B87000-memory.dmp

Filesize
156KB

Download
memory/1960-124-0x0000000003300000-0x0000000003329000-memory.dmp

Filesize
164KB

Download
memory/1960-127-0x0000000004D60000-0x0000000004DF0000-memory.dmp

Filesize
576KB

Download
memory/3044-121-0x0000000002C20000-0x0000000002D0C000-memory.dmp

Filesize
944KB

Download
memory/3044-128-0x00000000062C0000-0x0000000006419000-memory.dmp

Filesize
1.3MB

Download
memory/4232-117-0x000000000041D4C0-mapping.dmp

Download
memory/4232-119-0x0000000000A30000-0x0000000000D50000-memory.dmp

Filesize
3.1MB

Download
memory/4232-120-0x00000000005D0000-0x00000000005E1000-memory.dmp

Filesize
68KB

Download
memory/4232-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4272-126-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads