xloader | 62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6

General

Target

62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe
Size

464KB
MD5

87970c3d479f52f00f2b9de1ea942717
SHA1

751d93f7f3025d9c5487cd3382b082d89f38da8c
SHA256

62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6
SHA512

9e0434b917713b39621aff4253ec07fae3b2f7399c9293acd2243e09c091f1713df532e5bfb66fc25926cd0bec2456ec62b57ed0f685ad00e94e1d4d2c279c57

Score

10^/10

xloader b2c0 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1448-128-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1448-129-0x000000000041D4C0-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe

description	pid	process	target process
PID 1264 set thread context of 1448	1264	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

420 schtasks.exe

pid	process
420	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe

pid	process
1264	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe
1264	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe
1448	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe
1448	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe

description pid process

Token: SeDebugPrivilege 1264 62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe

description	pid	process
Token: SeDebugPrivilege	1264	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe

description	pid	process	target process
PID 1264 wrote to memory of 420	1264	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe	schtasks.exe
PID 1264 wrote to memory of 420	1264	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe	schtasks.exe
PID 1264 wrote to memory of 420	1264	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe	schtasks.exe
PID 1264 wrote to memory of 1448	1264	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe
PID 1264 wrote to memory of 1448	1264	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe
PID 1264 wrote to memory of 1448	1264	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe
PID 1264 wrote to memory of 1448	1264	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe
PID 1264 wrote to memory of 1448	1264	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe
PID 1264 wrote to memory of 1448	1264	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe	62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe

C:\Users\Admin\AppData\Local\Temp\62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe
"C:\Users\Admin\AppData\Local\Temp\62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XgriGEw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCF91.tmp"
2⤵
- Creates scheduled task(s)
PID:420

C:\Users\Admin\AppData\Local\Temp\62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe
"C:\Users\Admin\AppData\Local\Temp\62af6d80ae19c6beb856b49527eb3bb0d594e7f33c7cb927c7c58f72b9523ea6.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1448

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/420-127-0x0000000000000000-mapping.dmp

Download
memory/1264-118-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1264-120-0x0000000005130000-0x0000000005131000-memory.dmp

Filesize
4KB

Download
memory/1264-121-0x0000000004B60000-0x0000000004B61000-memory.dmp

Filesize
4KB

Download
memory/1264-122-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/1264-123-0x0000000004CC0000-0x0000000004CC7000-memory.dmp

Filesize
28KB

Download
memory/1264-124-0x0000000004C30000-0x000000000512E000-memory.dmp

Filesize
5.0MB

Download
memory/1264-125-0x0000000005910000-0x0000000005911000-memory.dmp

Filesize
4KB

Download
memory/1264-126-0x00000000058C0000-0x000000000590B000-memory.dmp

Filesize
300KB

Download
memory/1448-128-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1448-129-0x000000000041D4C0-mapping.dmp

Download
memory/1448-130-0x0000000001910000-0x0000000001C30000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads