xloader | 31771fa690e548c84e02a3fafcd518ab4d0e240d2f280279417002d8a25c7136

General

Target

PO410.EXE
Size

510KB
MD5

ad7186322cdd40e2b1b1611e483f7f3d
SHA1

6d21feb43f067ed236788e66c15e7dd0fe80de89
SHA256

daeedbdae991fad156f54e821b3bb18763922f0cff3b7331e23ae6bce40a4cc4
SHA512

b753101e66b98d6e99318ba958c5accc2dfb98b485d0176cd0d5665149bf732222d6082af4a9bba6f2a3b33d9f97b75fec0300419fe4a7373aac98ec800541fc

Score

10^/10

xloader hpin loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

hpin

C2

http://www.smgraphicdesign.com/hpin/

Decoy

lalashealingplace.com

melaniealdridgephotography.com

ss3369.com

career-bliss.com

handelbabu.quest

larryhover.com

xyz-vr.xyz

telvicedemo.net

aaakk95.com

follow-er.com

thepiwarrior.com

dgltqd.com

dailyswee.com

tonymoney.net

earthsidesoulalchemist.com

meditatieleeuwarden.online

blancorealtor.com

xn--erhardlohmller-psb.gmbh

coachtobetter.info

singpost.agency

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1176-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/1176-117-0x000000000041D480-mapping.dmp	xloader
behavioral2/memory/700-125-0x0000000000780000-0x00000000007A9000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

PO410.EXE

pid process

1336 PO410.EXE

pid	process
1336	PO410.EXE

Suspicious use of SetThreadContext 3 IoCs

Processes:

PO410.EXEPO410.EXEwscript.exe

description	pid	process	target process
PID 1336 set thread context of 1176	1336	PO410.EXE	PO410.EXE
PID 1176 set thread context of 2792	1176	PO410.EXE	Explorer.EXE
PID 700 set thread context of 2792	700	wscript.exe	Explorer.EXE

Drops file in Program Files directory 1 IoCs

Processes:

wscript.exe

description ioc process

File opened for modification C:\Program Files (x86)\Sedf4m\certmgrmboxnfe.exe wscript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Program Files (x86)\Sedf4m\certmgrmboxnfe.exe	wscript.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

PO410.EXEwscript.exe

pid	process
1176	PO410.EXE
1176	PO410.EXE
1176	PO410.EXE
1176	PO410.EXE
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe
700	wscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2792 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

PO410.EXEwscript.exe

pid process

1176 PO410.EXE
1176 PO410.EXE
1176 PO410.EXE
700 wscript.exe
700 wscript.exe

pid	process
2792	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

PO410.EXEwscript.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1176	PO410.EXE
Token: SeDebugPrivilege	700	wscript.exe
Token: SeShutdownPrivilege	2792	Explorer.EXE
Token: SeCreatePagefilePrivilege	2792	Explorer.EXE
Token: SeShutdownPrivilege	2792	Explorer.EXE
Token: SeCreatePagefilePrivilege	2792	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

PO410.EXEExplorer.EXEwscript.exe

description	pid	process	target process
PID 1336 wrote to memory of 1176	1336	PO410.EXE	PO410.EXE
PID 1336 wrote to memory of 1176	1336	PO410.EXE	PO410.EXE
PID 1336 wrote to memory of 1176	1336	PO410.EXE	PO410.EXE
PID 1336 wrote to memory of 1176	1336	PO410.EXE	PO410.EXE
PID 1336 wrote to memory of 1176	1336	PO410.EXE	PO410.EXE
PID 1336 wrote to memory of 1176	1336	PO410.EXE	PO410.EXE
PID 2792 wrote to memory of 700	2792	Explorer.EXE	wscript.exe
PID 2792 wrote to memory of 700	2792	Explorer.EXE	wscript.exe
PID 2792 wrote to memory of 700	2792	Explorer.EXE	wscript.exe
PID 700 wrote to memory of 2104	700	wscript.exe	cmd.exe
PID 700 wrote to memory of 2104	700	wscript.exe	cmd.exe
PID 700 wrote to memory of 2104	700	wscript.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792

C:\Users\Admin\AppData\Local\Temp\PO410.EXE
"C:\Users\Admin\AppData\Local\Temp\PO410.EXE"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1336

C:\Users\Admin\AppData\Local\Temp\PO410.EXE
"C:\Users\Admin\AppData\Local\Temp\PO410.EXE"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\SysWOW64\wscript.exe"
2⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:700

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\PO410.EXE"
3⤵
PID:2104

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsyFF03.tmp\wsbrkczsk.dll
MD5
099722351dc74e898ecabce1d16a3b64

SHA1
3dd5c13bec54537e1f2a5081a8ce93d2ac4f0d5a

SHA256
1895ecc21ae7170272a3466cfc75ae8e30565155cc301f7a4ea95834f672ea37

SHA512
a417bd75ff5b07dbb20db30537491dbcce4562c171a7bfc7a3931e0879d244930f1696d281b0dc0a8ab3802e25edf11cb752788d838e9333010847315caad39b

Download Submit
memory/700-125-0x0000000000780000-0x00000000007A9000-memory.dmp

Filesize
164KB

Download
memory/700-122-0x0000000000000000-mapping.dmp

Download
memory/700-124-0x0000000000FF0000-0x0000000001017000-memory.dmp

Filesize
156KB

Download
memory/700-126-0x0000000004C30000-0x0000000004F50000-memory.dmp

Filesize
3.1MB

Download
memory/700-127-0x00000000049F0000-0x0000000004A80000-memory.dmp

Filesize
576KB

Download
memory/1176-117-0x000000000041D480-mapping.dmp

Download
memory/1176-120-0x0000000000DB0000-0x0000000000DC1000-memory.dmp

Filesize
68KB

Download
memory/1176-119-0x0000000000990000-0x0000000000CB0000-memory.dmp

Filesize
3.1MB

Download
memory/1176-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2104-123-0x0000000000000000-mapping.dmp

Download
memory/2792-121-0x0000000003260000-0x0000000003312000-memory.dmp

Filesize
712KB

Download
memory/2792-128-0x0000000006E30000-0x0000000006F69000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads