xloader | e982c63be9c5eb7defc0ddbf72d27a5e6ea2fe2c050777595a831470ca9aa31e

General

Target

Unpaid invoice.exe
Size

450KB
MD5

98d2d5ac3bd493d77f0a7300a43d045b
SHA1

7fdd3b9b76f2c40df10def7ec3aa25c4fb192ec7
SHA256

1bbc8a34b7590c1593c5a79a8d0f93b17a162f44893c37aa11e4cb9e0e2d96bf
SHA512

32b7aa0518d6b41864d0f6f90d397cd377244b8f6af07178252aeb5b7ecf57e347c2aa2a3a4d94327d799bfcf8fe87b5c8164b0102c64258fd55a4c024ad0ef3

Score

10^/10

xloader b2c0 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4448-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/4448-117-0x000000000041D4C0-mapping.dmp	xloader
behavioral2/memory/4464-125-0x0000000000730000-0x0000000000759000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

Unpaid invoice.exe

pid process

4140 Unpaid invoice.exe

pid	process
4140	Unpaid invoice.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Unpaid invoice.exeUnpaid invoice.exeraserver.exe

description	pid	process	target process
PID 4140 set thread context of 4448	4140	Unpaid invoice.exe	Unpaid invoice.exe
PID 4448 set thread context of 2672	4448	Unpaid invoice.exe	Explorer.EXE
PID 4464 set thread context of 2672	4464	raserver.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

Unpaid invoice.exeraserver.exe

pid	process
4448	Unpaid invoice.exe
4448	Unpaid invoice.exe
4448	Unpaid invoice.exe
4448	Unpaid invoice.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe
4464	raserver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2672 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Unpaid invoice.exeraserver.exe

pid process

4448 Unpaid invoice.exe
4448 Unpaid invoice.exe
4448 Unpaid invoice.exe
4464 raserver.exe
4464 raserver.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Unpaid invoice.exeraserver.exe

description pid process

Token: SeDebugPrivilege 4448 Unpaid invoice.exe
Token: SeDebugPrivilege 4464 raserver.exe

pid	process
2672	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	4448	Unpaid invoice.exe
Token: SeDebugPrivilege	4464	raserver.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Unpaid invoice.exeExplorer.EXEraserver.exe

description	pid	process	target process
PID 4140 wrote to memory of 4448	4140	Unpaid invoice.exe	Unpaid invoice.exe
PID 4140 wrote to memory of 4448	4140	Unpaid invoice.exe	Unpaid invoice.exe
PID 4140 wrote to memory of 4448	4140	Unpaid invoice.exe	Unpaid invoice.exe
PID 4140 wrote to memory of 4448	4140	Unpaid invoice.exe	Unpaid invoice.exe
PID 4140 wrote to memory of 4448	4140	Unpaid invoice.exe	Unpaid invoice.exe
PID 4140 wrote to memory of 4448	4140	Unpaid invoice.exe	Unpaid invoice.exe
PID 2672 wrote to memory of 4464	2672	Explorer.EXE	raserver.exe
PID 2672 wrote to memory of 4464	2672	Explorer.EXE	raserver.exe
PID 2672 wrote to memory of 4464	2672	Explorer.EXE	raserver.exe
PID 4464 wrote to memory of 4624	4464	raserver.exe	cmd.exe
PID 4464 wrote to memory of 4624	4464	raserver.exe	cmd.exe
PID 4464 wrote to memory of 4624	4464	raserver.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2672

C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4140

C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Windows\SysWOW64\raserver.exe
"C:\Windows\SysWOW64\raserver.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe"
3⤵
PID:4624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nssF0AB.tmp\gyalquzbu.dll
MD5
a8caa6d267951ad22e835233b5e50c46

SHA1
45c722c5958d99727a95d30eaa3032203d1f4ab2

SHA256
db7b70b0734285b8d9a1f3617e55603b0cb649d9bf0b7fbf8988c44e684f4e76

SHA512
9ee74bf576554210f8923dda8aa28f6dc7f3c5aa52da7b48a94beaf56cb4e27f1c3d0387cc9116e467631bc13c0e743341129bffa84b9db16ace1248a53b4cd7

Download Submit
memory/2672-128-0x00000000059E0000-0x0000000005AEF000-memory.dmp

Filesize
1.1MB

Download
memory/2672-121-0x00000000058D0000-0x00000000059D3000-memory.dmp

Filesize
1.0MB

Download
memory/4448-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4448-117-0x000000000041D4C0-mapping.dmp

Download
memory/4448-119-0x0000000000950000-0x0000000000C70000-memory.dmp

Filesize
3.1MB

Download
memory/4448-120-0x00000000008D0000-0x00000000008E1000-memory.dmp

Filesize
68KB

Download
memory/4464-122-0x0000000000000000-mapping.dmp

Download
memory/4464-124-0x00000000010D0000-0x00000000010EF000-memory.dmp

Filesize
124KB

Download
memory/4464-125-0x0000000000730000-0x0000000000759000-memory.dmp

Filesize
164KB

Download
memory/4464-126-0x0000000004830000-0x0000000004B50000-memory.dmp

Filesize
3.1MB

Download
memory/4464-127-0x00000000046B0000-0x0000000004740000-memory.dmp

Filesize
576KB

Download
memory/4624-123-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads