xloader | bc42c1e528e70d0f4152e78278ed1a0e4bacf4cab8bb21da9ea8f99a48676355

Analysis

max time kernel
153s
max time network
159s
platform
windows10_x64
resource
win10-en-20211104
submitted
26/11/2021, 19:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e80b384d4465c98720ae1c0d2e965a5a.exe
Size 723KB
Sample211126-xx84fsecbj
SHA256 bc42c1e528e70d0f4152e78278ed1a0e4bacf4cab8bb21da9ea8f99a48676355
MD5 e80b384d4465c98720ae1c0d2e965a5a
SHA1 254274c5ccdd0e94590d89a9d852a462584eb482
SHA512 5cecf298c85d48a87e26593869c6c3c9de2bcec31b9ee1a343820d0d2ce9f78ceee213cb68c0b2ebde9a8da778e3d683df3b47b6a3495dba8487e594ba3006fa
MD5 SHA1 SHA512

Score

10^/10

xloader hno0 loader persistence rat suricata

Malware Config

Extracted

Family

xloader

Version

Campaign

hno0

http://www.heidecide.xyz/hno0/

Decoy

526854.rest
loosesalatoyof2.xyz
drillshear.com
kdsh-uae.com
firstnetinsurance.net
28684dw.com
hikinglifekr.com
astramed-clinic.store
24hxinh.com
livebongdatv.net
henrymaskph.com
newlanlan.com
txboilerparts.com
thepurldistrict.com
changemylifefast.info
sapphirecloset.com
ascensionmemberszoom.com
huffmanworks.com
techarcstudio.com
terbulen.store
naamgem.com
pwrsearch.com
al-solaiman.com
eastrwanda.com
ruihongco.com
grandrecordto-gathertoday.info
bleuexpress.com
estate.xyz
intlglobaldelivery.com
zeneplaza.com
citiesmalawi.properties
pumpkincheshire.com
sunflowerhub.com
zhongzhenghuagong.com
aquaticatt.com
kspqs.com
cpshapes.com
fgiheating.com
primasariutama.com
hotel-arcosdelparque.com
benjaminagencymarketing.com
whiteleyop.xyz
ahmty.net
transaction-immo.com
bungaauraprediction.com
profumeriamedici.com
olymporian.com
uprgoad.com
negotat.com
xn--z4qv1cr56dk0k.group
bestwlz.com
strongu-miner.com
presticgroup.com
cutos2.com
mintstationery.com
annengfanglei.com
carijualpt.com
chinagxsy.com
urzeczenie.com
dianyingyouquanquan.xyz
voucheraja.com
sdtcbh.com
hyslier.com
siebenmorgenband.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2256-120-0x0000000000000000-mapping.dmp	xloader
behavioral2/memory/2256-123-0x0000000074100000-0x0000000074129000-memory.dmp	xloader
behavioral2/memory/2444-190-0x0000000000330000-0x0000000000359000-memory.dmp	xloader

Executes dropped EXE 1 IoCs

pid	Process
3380	easinvoker.exe

Loads dropped DLL 1 IoCs

pid	Process
3380	easinvoker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run\Qfvepsqa = "C:\\Users\\Admin\\Contacts\\aqspevfQ.url"	e80b384d4465c98720ae1c0d2e965a5a.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2256 set thread context of 2264	2256	logagent.exe	38
PID 2444 set thread context of 2264	2444	mstsc.exe	38

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
820	PING.EXE

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
2256	logagent.exe
2256	logagent.exe
2256	logagent.exe
2256	logagent.exe
2252	powershell.exe
2252	powershell.exe
2252	powershell.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe
2444	mstsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2264	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2256	logagent.exe
2256	logagent.exe
2256	logagent.exe
2444	mstsc.exe
2444	mstsc.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	2256	logagent.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeShutdownPrivilege	2264	Explorer.EXE
Token: SeCreatePagefilePrivilege	2264	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	2252	powershell.exe
Token: SeSecurityPrivilege	2252	powershell.exe
Token: SeTakeOwnershipPrivilege	2252	powershell.exe
Token: SeLoadDriverPrivilege	2252	powershell.exe
Token: SeSystemProfilePrivilege	2252	powershell.exe
Token: SeSystemtimePrivilege	2252	powershell.exe
Token: SeProfSingleProcessPrivilege	2252	powershell.exe
Token: SeIncBasePriorityPrivilege	2252	powershell.exe
Token: SeCreatePagefilePrivilege	2252	powershell.exe
Token: SeBackupPrivilege	2252	powershell.exe
Token: SeRestorePrivilege	2252	powershell.exe
Token: SeShutdownPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeSystemEnvironmentPrivilege	2252	powershell.exe
Token: SeRemoteShutdownPrivilege	2252	powershell.exe
Token: SeUndockPrivilege	2252	powershell.exe
Token: SeManageVolumePrivilege	2252	powershell.exe
Token: 33	2252	powershell.exe
Token: 34	2252	powershell.exe
Token: 35	2252	powershell.exe
Token: 36	2252	powershell.exe
Token: SeShutdownPrivilege	2264	Explorer.EXE
Token: SeCreatePagefilePrivilege	2264	Explorer.EXE
Token: SeDebugPrivilege	2444	mstsc.exe
Token: SeShutdownPrivilege	2264	Explorer.EXE
Token: SeCreatePagefilePrivilege	2264	Explorer.EXE
Token: SeShutdownPrivilege	2264	Explorer.EXE
Token: SeCreatePagefilePrivilege	2264	Explorer.EXE

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2256	2368	e80b384d4465c98720ae1c0d2e965a5a.exe	69
PID 2368 wrote to memory of 2256	2368	e80b384d4465c98720ae1c0d2e965a5a.exe	69
PID 2368 wrote to memory of 2256	2368	e80b384d4465c98720ae1c0d2e965a5a.exe	69
PID 2368 wrote to memory of 2256	2368	e80b384d4465c98720ae1c0d2e965a5a.exe	69
PID 2368 wrote to memory of 2256	2368	e80b384d4465c98720ae1c0d2e965a5a.exe	69
PID 2368 wrote to memory of 2256	2368	e80b384d4465c98720ae1c0d2e965a5a.exe	69
PID 2368 wrote to memory of 3876	2368	e80b384d4465c98720ae1c0d2e965a5a.exe	70
PID 2368 wrote to memory of 3876	2368	e80b384d4465c98720ae1c0d2e965a5a.exe	70
PID 2368 wrote to memory of 3876	2368	e80b384d4465c98720ae1c0d2e965a5a.exe	70
PID 3876 wrote to memory of 2720	3876	cmd.exe	72
PID 3876 wrote to memory of 2720	3876	cmd.exe	72
PID 3876 wrote to memory of 2720	3876	cmd.exe	72
PID 2720 wrote to memory of 1160	2720	cmd.exe	74
PID 2720 wrote to memory of 1160	2720	cmd.exe	74
PID 2720 wrote to memory of 1160	2720	cmd.exe	74
PID 2720 wrote to memory of 1360	2720	cmd.exe	75
PID 2720 wrote to memory of 1360	2720	cmd.exe	75
PID 2720 wrote to memory of 1360	2720	cmd.exe	75
PID 2720 wrote to memory of 600	2720	cmd.exe	76
PID 2720 wrote to memory of 600	2720	cmd.exe	76
PID 2720 wrote to memory of 600	2720	cmd.exe	76
PID 2720 wrote to memory of 392	2720	cmd.exe	77
PID 2720 wrote to memory of 392	2720	cmd.exe	77
PID 2720 wrote to memory of 392	2720	cmd.exe	77
PID 2720 wrote to memory of 2504	2720	cmd.exe	78
PID 2720 wrote to memory of 2504	2720	cmd.exe	78
PID 2720 wrote to memory of 2504	2720	cmd.exe	78
PID 2720 wrote to memory of 2564	2720	cmd.exe	79
PID 2720 wrote to memory of 2564	2720	cmd.exe	79
PID 2720 wrote to memory of 2564	2720	cmd.exe	79
PID 2720 wrote to memory of 3380	2720	cmd.exe	80
PID 2720 wrote to memory of 3380	2720	cmd.exe	80
PID 3380 wrote to memory of 788	3380	easinvoker.exe	81
PID 3380 wrote to memory of 788	3380	easinvoker.exe	81
PID 2720 wrote to memory of 820	2720	cmd.exe	83
PID 2720 wrote to memory of 820	2720	cmd.exe	83
PID 2720 wrote to memory of 820	2720	cmd.exe	83
PID 788 wrote to memory of 2252	788	cmd.exe	84
PID 788 wrote to memory of 2252	788	cmd.exe	84
PID 2264 wrote to memory of 2444	2264	Explorer.EXE	87
PID 2264 wrote to memory of 2444	2264	Explorer.EXE	87
PID 2264 wrote to memory of 2444	2264	Explorer.EXE	87
PID 2444 wrote to memory of 2904	2444	mstsc.exe	89
PID 2444 wrote to memory of 2904	2444	mstsc.exe	89
PID 2444 wrote to memory of 2904	2444	mstsc.exe	89

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\e80b384d4465c98720ae1c0d2e965a5a.exe
  "C:\Users\Admin\AppData\Local\Temp\e80b384d4465c98720ae1c0d2e965a5a.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\logagent.exe
    C:\Windows\System32\logagent.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Contacts\System32\Trast.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\Contacts\System32\UKO.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2720
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
        5⤵
        
        PID:1160
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy "NETUTILS.exe" "C:\Windows \System32\easinvoker.exe" /K /D /H /Y
        5⤵
        Enumerates system info in registry
        
        PID:1360
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
        5⤵
        
        PID:600
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy "KDECO.bat" "C:\Windows \System32\" /K /D /H /Y
        5⤵
        Enumerates system info in registry
        
        PID:392
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECHO F"
        5⤵
        
        PID:2504
    - - C:\Windows\SysWOW64\xcopy.exe
        
        xcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y
        5⤵
        Enumerates system info in registry
        
        PID:2564
    - - C:\Windows \System32\easinvoker.exe
        
        "C:\Windows \System32\easinvoker.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3380
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Windows \System32\KDECO.bat""
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 6
        5⤵
        Runs ping.exe
        
        PID:820
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1432
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\SysWOW64\mstsc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\SysWOW64\logagent.exe"
    3⤵
    PID:2904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2252-146-0x000002DC57B90000-0x000002DC57B92000-memory.dmp

Download

memory/2252-152-0x000002DC57B90000-0x000002DC57B92000-memory.dmp

Download

memory/2252-159-0x000002DC71B20000-0x000002DC71B22000-memory.dmp

Download

memory/2252-188-0x000002DC57B90000-0x000002DC57B92000-memory.dmp

Download

memory/2252-164-0x000002DC71B26000-0x000002DC71B28000-memory.dmp

Download

memory/2252-156-0x000002DC73FE0000-0x000002DC73FE1000-memory.dmp

Download

memory/2252-154-0x000002DC57B90000-0x000002DC57B92000-memory.dmp

Download

memory/2252-155-0x000002DC57B90000-0x000002DC57B92000-memory.dmp

Download

memory/2252-153-0x000002DC57B90000-0x000002DC57B92000-memory.dmp

Download

memory/2252-161-0x000002DC57B90000-0x000002DC57B92000-memory.dmp

Download

memory/2252-147-0x000002DC57B90000-0x000002DC57B92000-memory.dmp

Download

memory/2252-148-0x000002DC57B90000-0x000002DC57B92000-memory.dmp

Download

memory/2252-149-0x000002DC57B90000-0x000002DC57B92000-memory.dmp

Download

memory/2252-150-0x000002DC57B90000-0x000002DC57B92000-memory.dmp

Download

memory/2252-151-0x000002DC59850000-0x000002DC59851000-memory.dmp

Download

memory/2252-160-0x000002DC71B23000-0x000002DC71B25000-memory.dmp

Download

memory/2256-145-0x0000000004F90000-0x00000000052B0000-memory.dmp

Download

memory/2256-122-0x00000000010E0000-0x00000000010E1000-memory.dmp

Download

memory/2256-123-0x0000000074100000-0x0000000074129000-memory.dmp

Download

memory/2256-157-0x0000000004F10000-0x0000000004F21000-memory.dmp

Download

memory/2264-158-0x00000000058F0000-0x0000000005A3F000-memory.dmp

Download

memory/2264-195-0x0000000005A40000-0x0000000005B51000-memory.dmp

Download

memory/2368-118-0x0000000000550000-0x00000000005FE000-memory.dmp

Download

memory/2368-119-0x00000000005F1000-0x0000000000605000-memory.dmp

Download

memory/2444-189-0x0000000000D70000-0x000000000106C000-memory.dmp

Download

memory/2444-190-0x0000000000330000-0x0000000000359000-memory.dmp

Download

memory/2444-191-0x0000000004940000-0x0000000004C60000-memory.dmp

Download

memory/2444-194-0x0000000000CB0000-0x0000000000D40000-memory.dmp

Download