xloader | 9f1a46f25ff46ddc69bb64b4bffbf628e41eb6c4820c617bfb06fd287e8cd08a

General

Target

swift.exe
Size

838KB
MD5

dae40883df63939076b90643ea59bc79
SHA1

cb5d1491347cc417bcc1d1e4090c8d6da787daec
SHA256

9f1a46f25ff46ddc69bb64b4bffbf628e41eb6c4820c617bfb06fd287e8cd08a
SHA512

a709fceca7430ae88e4d2d68bb166337820519293fbad8ec118c132ba0cf04872f75d3d27876a2589f8c6db31eee368f1882c9a5a654821370a0ffea4820cb8a

Score

10^/10

xloader rqan loader persistence rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

rqan

C2

http://www.cardboutiqueapp.com/rqan/

Decoy

panda.wiki

gailkannamassage.com

ungravitystudio.com

coraggiomusicschool.com

51walkerstreetrippleside.com

infemax.store

mapara-foundation.net

elitespeedwaxs.com

manateeprint.com

thelocksmithtradeshow.com

phoenix-out-of-ashes.com

marionkgregory.store

abasketofwords.com

century21nokta.com

anthonyaarnold.com

forevermyanmar.com

ramashi.com

uniquecarbonbrush.com

packecco.com

appelnacrtl.quest

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1736-117-0x0000000000000000-mapping.dmp	xloader
behavioral2/memory/1736-119-0x0000000072480000-0x00000000724A9000-memory.dmp	xloader
behavioral2/memory/4556-126-0x00000000003B0000-0x00000000003D9000-memory.dmp	xloader

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

swift.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ugzrspqk = "C:\\Users\\Public\\kqpsrzgU.url"	swift.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

mobsync.exechkdsk.exe

description	pid	process	target process
PID 1736 set thread context of 3040	1736	mobsync.exe	Explorer.EXE
PID 4556 set thread context of 3040	4556	chkdsk.exe	Explorer.EXE

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

chkdsk.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

Processes:

mobsync.exechkdsk.exe

pid	process
1736	mobsync.exe
1736	mobsync.exe
1736	mobsync.exe
1736	mobsync.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe
4556	chkdsk.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3040 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

mobsync.exechkdsk.exe

pid process

1736 mobsync.exe
1736 mobsync.exe
1736 mobsync.exe
4556 chkdsk.exe
4556 chkdsk.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

mobsync.exechkdsk.exe

description pid process

Token: SeDebugPrivilege 1736 mobsync.exe
Token: SeDebugPrivilege 4556 chkdsk.exe

pid	process
3040	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1736	mobsync.exe
Token: SeDebugPrivilege	4556	chkdsk.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

swift.exeExplorer.EXE

description	pid	process	target process
PID 4368 wrote to memory of 1736	4368	swift.exe	mobsync.exe
PID 4368 wrote to memory of 1736	4368	swift.exe	mobsync.exe
PID 4368 wrote to memory of 1736	4368	swift.exe	mobsync.exe
PID 4368 wrote to memory of 1736	4368	swift.exe	mobsync.exe
PID 4368 wrote to memory of 1736	4368	swift.exe	mobsync.exe
PID 4368 wrote to memory of 1736	4368	swift.exe	mobsync.exe
PID 3040 wrote to memory of 4556	3040	Explorer.EXE	chkdsk.exe
PID 3040 wrote to memory of 4556	3040	Explorer.EXE	chkdsk.exe
PID 3040 wrote to memory of 4556	3040	Explorer.EXE	chkdsk.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3040

C:\Users\Admin\AppData\Local\Temp\swift.exe
"C:\Users\Admin\AppData\Local\Temp\swift.exe"
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4368

C:\Windows\SysWOW64\mobsync.exe
C:\Windows\System32\mobsync.exe
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Windows\SysWOW64\chkdsk.exe
"C:\Windows\SysWOW64\chkdsk.exe"
2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-121-0x0000000004EC0000-0x00000000051E0000-memory.dmp

Filesize
3.1MB

Download
memory/1736-117-0x0000000000000000-mapping.dmp

Download
memory/1736-118-0x0000000003000000-0x0000000003001000-memory.dmp

Filesize
4KB

Download
memory/1736-119-0x0000000072480000-0x00000000724A9000-memory.dmp

Filesize
164KB

Download
memory/1736-122-0x0000000003690000-0x00000000036A1000-memory.dmp

Filesize
68KB

Download
memory/3040-123-0x0000000002E80000-0x0000000002F7A000-memory.dmp

Filesize
1000KB

Download
memory/3040-129-0x0000000003000000-0x00000000030FF000-memory.dmp

Filesize
1020KB

Download
memory/4368-115-0x0000000000710000-0x0000000000735000-memory.dmp

Filesize
148KB

Download
memory/4368-116-0x0000000002411000-0x0000000002425000-memory.dmp

Filesize
80KB

Download
memory/4556-126-0x00000000003B0000-0x00000000003D9000-memory.dmp

Filesize
164KB

Download
memory/4556-125-0x0000000000A70000-0x0000000000A7A000-memory.dmp

Filesize
40KB

Download
memory/4556-124-0x0000000000000000-mapping.dmp

Download
memory/4556-127-0x0000000004ED0000-0x00000000051F0000-memory.dmp

Filesize
3.1MB

Download
memory/4556-128-0x0000000004B90000-0x0000000004C20000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads