xloader | d37aa13c134ce2c1938ce9b4745cfe5af5c3b8348bc7b669731592596bef5e48

General

Target
swift_copy_ 1257.exe
Size 358KB
Sample211110-nffadaghd9
SHA256 d37aa13c134ce2c1938ce9b4745cfe5af5c3b8348bc7b669731592596bef5e48
MD5 af70790444c9116f55d30d4cc68aff0e
SHA1 dd37c23397b8e058810e1a4727be8959330b66ff
SHA512 6e261093bc28118703877e7664e05cdb7dfe1fc7ae52d4de741b82d613b4fd0896ef1cbb2ef5a9d9a7dcc78315621403833e9507baabfab7253f2b06a9a10c9a
MD5 SHA1 SHA512

Score

10^/10

xloader rht9 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

rht9

C2

http://www.mgav63.xyz/rht9/

Decoy

fascialboost.com
taxing.systems
lorodicahtoyof5.xyz
shinanokizaki.info
sunloved.com
yasuapp.net
bondingbnuqkb.xyz
lineage2bk.store
anahole.com
shujufangzhou.com
xtrategit.com
customersevicebest.online
bombapeniana.store
holmborg.store
aenrione.xyz
dandftrading.com
br85115.top
factualforfgu.xyz
thatsmyrocketmortgage.com
canadairontoken.com
presionando.xyz
lisadecore.com
thepotatobox.com
cxhy.online
justdonteatclub.com
labstudyguide.com
amandaznaprawa.com
brightonbybench.xyz
paramusoffices.com
topfuna.com
asbrpl.com
wonderchef.xyz
rainytravel.com
f2itsolutions.com
yutokoso.com
nulinu.online
pp-1g-k13-zia-9z.top
conceptasite.net
rantangfood.online
nightpartner89.xyz
rcsrc.com
oligopoly.cruises
adelaideofficefitouts.com
biggirlrantz.com
goldenhoop.xyz
winetb.com
playhardplaynice.com
bake8teen.com
oinfoproduto.com
asian-bodywork.com
eastendfinances.com
hebeidiping.com
thepackhack.com
eagleproperties.net
topay.biz
foramour.art
yoursacredquest.com
ashkonlaura.com
xzflxx.com
wg388.com
misznunoz.com
radosenterprisellc.com
mrbubblesftlauderdale.com
zeogg.club

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1256-57-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1256-58-0x000000000041D410-mapping.dmp	xloader
behavioral1/memory/584-65-0x0000000000070000-0x0000000000099000-memory.dmp	xloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
32	584	wscript.exe

Deletes itself 1 IoCs

pid	Process
1936	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1696	swift_copy_ 1257.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1696 set thread context of 1256	1696	swift_copy_ 1257.exe	28
PID 1256 set thread context of 1212	1256	swift_copy_ 1257.exe	9
PID 584 set thread context of 1212	584	wscript.exe	9

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1256	swift_copy_ 1257.exe
1256	swift_copy_ 1257.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe
584	wscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1212	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1256	swift_copy_ 1257.exe
1256	swift_copy_ 1257.exe
1256	swift_copy_ 1257.exe
584	wscript.exe
584	wscript.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1256	swift_copy_ 1257.exe
Token: SeDebugPrivilege	584	wscript.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1256	1696	swift_copy_ 1257.exe	28
PID 1696 wrote to memory of 1256	1696	swift_copy_ 1257.exe	28
PID 1696 wrote to memory of 1256	1696	swift_copy_ 1257.exe	28
PID 1696 wrote to memory of 1256	1696	swift_copy_ 1257.exe	28
PID 1696 wrote to memory of 1256	1696	swift_copy_ 1257.exe	28
PID 1696 wrote to memory of 1256	1696	swift_copy_ 1257.exe	28
PID 1696 wrote to memory of 1256	1696	swift_copy_ 1257.exe	28
PID 1212 wrote to memory of 584	1212	Explorer.EXE	29
PID 1212 wrote to memory of 584	1212	Explorer.EXE	29
PID 1212 wrote to memory of 584	1212	Explorer.EXE	29
PID 1212 wrote to memory of 584	1212	Explorer.EXE	29
PID 584 wrote to memory of 1936	584	wscript.exe	30
PID 584 wrote to memory of 1936	584	wscript.exe	30
PID 584 wrote to memory of 1936	584	wscript.exe	30
PID 584 wrote to memory of 1936	584	wscript.exe	30

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Local\Temp\swift_copy_ 1257.exe
  "C:\Users\Admin\AppData\Local\Temp\swift_copy_ 1257.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\swift_copy_ 1257.exe
    "C:\Users\Admin\AppData\Local\Temp\swift_copy_ 1257.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1256
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\SysWOW64\wscript.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:584
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\swift_copy_ 1257.exe"
    3⤵
    - Deletes itself
    PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-68-0x0000000000BA0000-0x0000000000C30000-memory.dmp

Download

memory/584-65-0x0000000000070000-0x0000000000099000-memory.dmp

Download

memory/584-66-0x0000000002410000-0x0000000002713000-memory.dmp

Download

memory/584-64-0x0000000000FE0000-0x0000000001006000-memory.dmp

Download

memory/1212-62-0x0000000005FB0000-0x0000000006073000-memory.dmp

Download

memory/1212-69-0x0000000007980000-0x0000000007AF1000-memory.dmp

Download

memory/1256-60-0x00000000008D0000-0x0000000000BD3000-memory.dmp

Download

memory/1256-61-0x0000000000340000-0x0000000000351000-memory.dmp

Download

memory/1256-57-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1696-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads