xloader | e982c63be9c5eb7defc0ddbf72d27a5e6ea2fe2c050777595a831470ca9aa31e

General

Target

Unpaid invoice.exe
Size

450KB
MD5

98d2d5ac3bd493d77f0a7300a43d045b
SHA1

7fdd3b9b76f2c40df10def7ec3aa25c4fb192ec7
SHA256

1bbc8a34b7590c1593c5a79a8d0f93b17a162f44893c37aa11e4cb9e0e2d96bf
SHA512

32b7aa0518d6b41864d0f6f90d397cd377244b8f6af07178252aeb5b7ecf57e347c2aa2a3a4d94327d799bfcf8fe87b5c8164b0102c64258fd55a4c024ad0ef3

Score

10^/10

xloader b2c0 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2644-117-0x000000000041D4C0-mapping.dmp	xloader
behavioral2/memory/2644-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/472-125-0x0000000001040000-0x0000000001069000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

Unpaid invoice.exe

pid process

1656 Unpaid invoice.exe

pid	process
1656	Unpaid invoice.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Unpaid invoice.exeUnpaid invoice.exerundll32.exe

description	pid	process	target process
PID 1656 set thread context of 2644	1656	Unpaid invoice.exe	Unpaid invoice.exe
PID 2644 set thread context of 3020	2644	Unpaid invoice.exe	Explorer.EXE
PID 472 set thread context of 3020	472	rundll32.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

Unpaid invoice.exerundll32.exe

pid	process
2644	Unpaid invoice.exe
2644	Unpaid invoice.exe
2644	Unpaid invoice.exe
2644	Unpaid invoice.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe
472	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3020 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Unpaid invoice.exerundll32.exe

pid process

2644 Unpaid invoice.exe
2644 Unpaid invoice.exe
2644 Unpaid invoice.exe
472 rundll32.exe
472 rundll32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Unpaid invoice.exerundll32.exe

description pid process

Token: SeDebugPrivilege 2644 Unpaid invoice.exe
Token: SeDebugPrivilege 472 rundll32.exe

pid	process
3020	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	2644	Unpaid invoice.exe
Token: SeDebugPrivilege	472	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Unpaid invoice.exeExplorer.EXErundll32.exe

description	pid	process	target process
PID 1656 wrote to memory of 2644	1656	Unpaid invoice.exe	Unpaid invoice.exe
PID 1656 wrote to memory of 2644	1656	Unpaid invoice.exe	Unpaid invoice.exe
PID 1656 wrote to memory of 2644	1656	Unpaid invoice.exe	Unpaid invoice.exe
PID 1656 wrote to memory of 2644	1656	Unpaid invoice.exe	Unpaid invoice.exe
PID 1656 wrote to memory of 2644	1656	Unpaid invoice.exe	Unpaid invoice.exe
PID 1656 wrote to memory of 2644	1656	Unpaid invoice.exe	Unpaid invoice.exe
PID 3020 wrote to memory of 472	3020	Explorer.EXE	rundll32.exe
PID 3020 wrote to memory of 472	3020	Explorer.EXE	rundll32.exe
PID 3020 wrote to memory of 472	3020	Explorer.EXE	rundll32.exe
PID 472 wrote to memory of 1916	472	rundll32.exe	cmd.exe
PID 472 wrote to memory of 1916	472	rundll32.exe	cmd.exe
PID 472 wrote to memory of 1916	472	rundll32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3020

C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:472

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe"
3⤵
PID:1916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nshEFD0.tmp\gyalquzbu.dll
MD5
a8caa6d267951ad22e835233b5e50c46

SHA1
45c722c5958d99727a95d30eaa3032203d1f4ab2

SHA256
db7b70b0734285b8d9a1f3617e55603b0cb649d9bf0b7fbf8988c44e684f4e76

SHA512
9ee74bf576554210f8923dda8aa28f6dc7f3c5aa52da7b48a94beaf56cb4e27f1c3d0387cc9116e467631bc13c0e743341129bffa84b9db16ace1248a53b4cd7

Download Submit
memory/472-124-0x0000000001170000-0x0000000001183000-memory.dmp

Filesize
76KB

Download
memory/472-122-0x0000000000000000-mapping.dmp

Download
memory/472-125-0x0000000001040000-0x0000000001069000-memory.dmp

Filesize
164KB

Download
memory/472-126-0x00000000050E0000-0x0000000005400000-memory.dmp

Filesize
3.1MB

Download
memory/472-127-0x0000000004F30000-0x0000000004FC0000-memory.dmp

Filesize
576KB

Download
memory/1916-123-0x0000000000000000-mapping.dmp

Download
memory/2644-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2644-120-0x00000000005E0000-0x00000000005F1000-memory.dmp

Filesize
68KB

Download
memory/2644-119-0x0000000000A40000-0x0000000000D60000-memory.dmp

Filesize
3.1MB

Download
memory/2644-117-0x000000000041D4C0-mapping.dmp

Download
memory/3020-121-0x00000000024C0000-0x000000000259A000-memory.dmp

Filesize
872KB

Download
memory/3020-128-0x0000000000520000-0x00000000005C4000-memory.dmp

Filesize
656KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads