xloader | 3ed36b8022b12ec4f03856980ae7bcbdd4b0e192bc7c0dbf4b4c190e24b5eac0

General

Target

SOA.exe
Size

580KB
MD5

a0661a2081100ffcb2a6f012237c4955
SHA1

2331112fa3c9357aaba68c3d7402b112c705c72a
SHA256

11f0960531aa51e1fc9e04c007c60d731d309baa35e90d9d4e9c49feff74d47d
SHA512

dd3173fd770ec1601a6b454d450ce8118c596b3e72ead12c79df5f3dd4165be9892b8273775b9da1aa6136a55898bfb31a4da2c16e15303b402c00e9b117b774

Score

10^/10

xloader imm8 loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

imm8

C2

http://www.hideserthealthinsurance.com/imm8/

Decoy

ewgnkxdgtqfspem.com

patxipiruli.com

eejy.ltd

parc-pro.com

kdcindia.com

dimathi.com

majesticreinsstable.com

zhaoyun.xyz

starfroot.com

dikanwang.com

420moxielane.com

danilaschembri.com

stablecoinreviews.com

camham.co.uk

happyspaces4life.com

ivonina.com

businesszukai.com

dietkusimple.com

nomeasureu.com

youthcampresources.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1976-62-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/1976-63-0x000000000041D030-mapping.dmp	xloader
behavioral1/memory/1404-71-0x0000000000070000-0x0000000000098000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

Processes:

SOA.exeRegSvcs.exewscript.exe

description	pid	process	target process
PID 1528 set thread context of 1976	1528	SOA.exe	RegSvcs.exe
PID 1976 set thread context of 1408	1976	RegSvcs.exe	Explorer.EXE
PID 1404 set thread context of 1408	1404	wscript.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

SOA.exeRegSvcs.exewscript.exe

pid	process
1528	SOA.exe
1528	SOA.exe
1528	SOA.exe
1528	SOA.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe
1404	wscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1408 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

RegSvcs.exewscript.exe

pid process

1976 RegSvcs.exe
1976 RegSvcs.exe
1976 RegSvcs.exe
1404 wscript.exe
1404 wscript.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

SOA.exeRegSvcs.exewscript.exe

description pid process

Token: SeDebugPrivilege 1528 SOA.exe
Token: SeDebugPrivilege 1976 RegSvcs.exe
Token: SeDebugPrivilege 1404 wscript.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1408 Explorer.EXE
1408 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1408 Explorer.EXE
1408 Explorer.EXE

pid	process
1408	Explorer.EXE

pid	process
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1404	wscript.exe
1404	wscript.exe

description	pid	process
Token: SeDebugPrivilege	1528	SOA.exe
Token: SeDebugPrivilege	1976	RegSvcs.exe
Token: SeDebugPrivilege	1404	wscript.exe

pid	process
1408	Explorer.EXE
1408	Explorer.EXE

pid	process
1408	Explorer.EXE
1408	Explorer.EXE

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

SOA.exeExplorer.EXEwscript.exe

description	pid	process	target process
PID 1528 wrote to memory of 1752	1528	SOA.exe	RegSvcs.exe
PID 1528 wrote to memory of 1752	1528	SOA.exe	RegSvcs.exe
PID 1528 wrote to memory of 1752	1528	SOA.exe	RegSvcs.exe
PID 1528 wrote to memory of 1752	1528	SOA.exe	RegSvcs.exe
PID 1528 wrote to memory of 1752	1528	SOA.exe	RegSvcs.exe
PID 1528 wrote to memory of 1752	1528	SOA.exe	RegSvcs.exe
PID 1528 wrote to memory of 1752	1528	SOA.exe	RegSvcs.exe
PID 1528 wrote to memory of 1976	1528	SOA.exe	RegSvcs.exe
PID 1528 wrote to memory of 1976	1528	SOA.exe	RegSvcs.exe
PID 1528 wrote to memory of 1976	1528	SOA.exe	RegSvcs.exe
PID 1528 wrote to memory of 1976	1528	SOA.exe	RegSvcs.exe
PID 1528 wrote to memory of 1976	1528	SOA.exe	RegSvcs.exe
PID 1528 wrote to memory of 1976	1528	SOA.exe	RegSvcs.exe
PID 1528 wrote to memory of 1976	1528	SOA.exe	RegSvcs.exe
PID 1528 wrote to memory of 1976	1528	SOA.exe	RegSvcs.exe
PID 1528 wrote to memory of 1976	1528	SOA.exe	RegSvcs.exe
PID 1528 wrote to memory of 1976	1528	SOA.exe	RegSvcs.exe
PID 1408 wrote to memory of 1404	1408	Explorer.EXE	wscript.exe
PID 1408 wrote to memory of 1404	1408	Explorer.EXE	wscript.exe
PID 1408 wrote to memory of 1404	1408	Explorer.EXE	wscript.exe
PID 1408 wrote to memory of 1404	1408	Explorer.EXE	wscript.exe
PID 1404 wrote to memory of 792	1404	wscript.exe	cmd.exe
PID 1404 wrote to memory of 792	1404	wscript.exe	cmd.exe
PID 1404 wrote to memory of 792	1404	wscript.exe	cmd.exe
PID 1404 wrote to memory of 792	1404	wscript.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1408

C:\Users\Admin\AppData\Local\Temp\SOA.exe
"C:\Users\Admin\AppData\Local\Temp\SOA.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
PID:1752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\SysWOW64\wscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
PID:792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/792-69-0x0000000000000000-mapping.dmp

Download
memory/1404-73-0x0000000001EB0000-0x0000000001F3F000-memory.dmp

Filesize
572KB

Download
memory/1404-70-0x0000000000A80000-0x0000000000AA6000-memory.dmp

Filesize
152KB

Download
memory/1404-72-0x0000000002180000-0x0000000002483000-memory.dmp

Filesize
3.0MB

Download
memory/1404-71-0x0000000000070000-0x0000000000098000-memory.dmp

Filesize
160KB

Download
memory/1404-68-0x0000000000000000-mapping.dmp

Download
memory/1408-67-0x0000000007130000-0x000000000724C000-memory.dmp

Filesize
1.1MB

Download
memory/1408-74-0x0000000007540000-0x0000000007652000-memory.dmp

Filesize
1.1MB

Download
memory/1528-59-0x00000000006E0000-0x0000000000723000-memory.dmp

Filesize
268KB

Download
memory/1528-54-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1528-58-0x0000000005F60000-0x0000000005FD8000-memory.dmp

Filesize
480KB

Download
memory/1528-57-0x0000000000480000-0x0000000000487000-memory.dmp

Filesize
28KB

Download
memory/1528-56-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/1976-65-0x00000000008C0000-0x0000000000BC3000-memory.dmp

Filesize
3.0MB

Download
memory/1976-66-0x0000000000280000-0x0000000000290000-memory.dmp

Filesize
64KB

Download
memory/1976-63-0x000000000041D030-mapping.dmp

Download
memory/1976-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1976-61-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1976-60-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads