xloader | e745235386d1908e2bf40be43cf982932ce8b1604fe59ed2195aee341becb7c3

General

Target

payment advice_008900112.exe
Size

246KB
MD5

0783312f7caf72f1ac2a9951145bdda4
SHA1

c3da5594f78880bd4fc1d496efca357e6c19f65a
SHA256

e745235386d1908e2bf40be43cf982932ce8b1604fe59ed2195aee341becb7c3
SHA512

1270782a3aa83186265d8253781d0af5aa5769ccff033672c4f42d27f1be73e7cd2dbe9adbd448a3c09841285c54523fd682721724564794ce152ffbde38d0e1

Score

10^/10

xloader cxep loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

cxep

Decoy

estateglobal.info

loransstore.com

loginofy.com

fjallravenz.online

cefseguranca-app.com

safontadiestramiento.com

bubbleteapro.com

morethanmummies.com

serviciopersonalizadoweb.com

headerbidder.info

skworkforce.com

heightsorthodontics.com

chulavistapd.com

southjerseyautobody.net

chargedbygratitude.com

meltingpotspot.com

gdjiachen.com

luckdrawprogram.com

vintagepaseo.com

bequestslojyh.xyz

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/464-56-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1480-64-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1252 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

payment advice_008900112.exe

pid process

1400 payment advice_008900112.exe

pid	process
1252	cmd.exe

pid	process
1400	payment advice_008900112.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

payment advice_008900112.exepayment advice_008900112.execolorcpl.exe

description	pid	process	target process
PID 1400 set thread context of 464	1400	payment advice_008900112.exe	payment advice_008900112.exe
PID 464 set thread context of 1408	464	payment advice_008900112.exe	Explorer.EXE
PID 1480 set thread context of 1408	1480	colorcpl.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

payment advice_008900112.execolorcpl.exe

pid	process
464	payment advice_008900112.exe
464	payment advice_008900112.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe
1480	colorcpl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1408 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

payment advice_008900112.execolorcpl.exe

pid process

464 payment advice_008900112.exe
464 payment advice_008900112.exe
464 payment advice_008900112.exe
1480 colorcpl.exe
1480 colorcpl.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

payment advice_008900112.execolorcpl.exe

description pid process

Token: SeDebugPrivilege 464 payment advice_008900112.exe
Token: SeDebugPrivilege 1480 colorcpl.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1408 Explorer.EXE
1408 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1408 Explorer.EXE
1408 Explorer.EXE

pid	process
1408	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	464	payment advice_008900112.exe
Token: SeDebugPrivilege	1480	colorcpl.exe

pid	process
1408	Explorer.EXE
1408	Explorer.EXE

pid	process
1408	Explorer.EXE
1408	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

payment advice_008900112.exeExplorer.EXEcolorcpl.exe

description	pid	process	target process
PID 1400 wrote to memory of 464	1400	payment advice_008900112.exe	payment advice_008900112.exe
PID 1400 wrote to memory of 464	1400	payment advice_008900112.exe	payment advice_008900112.exe
PID 1400 wrote to memory of 464	1400	payment advice_008900112.exe	payment advice_008900112.exe
PID 1400 wrote to memory of 464	1400	payment advice_008900112.exe	payment advice_008900112.exe
PID 1400 wrote to memory of 464	1400	payment advice_008900112.exe	payment advice_008900112.exe
PID 1400 wrote to memory of 464	1400	payment advice_008900112.exe	payment advice_008900112.exe
PID 1400 wrote to memory of 464	1400	payment advice_008900112.exe	payment advice_008900112.exe
PID 1408 wrote to memory of 1480	1408	Explorer.EXE	colorcpl.exe
PID 1408 wrote to memory of 1480	1408	Explorer.EXE	colorcpl.exe
PID 1408 wrote to memory of 1480	1408	Explorer.EXE	colorcpl.exe
PID 1408 wrote to memory of 1480	1408	Explorer.EXE	colorcpl.exe
PID 1480 wrote to memory of 1252	1480	colorcpl.exe	cmd.exe
PID 1480 wrote to memory of 1252	1480	colorcpl.exe	cmd.exe
PID 1480 wrote to memory of 1252	1480	colorcpl.exe	cmd.exe
PID 1480 wrote to memory of 1252	1480	colorcpl.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1408

C:\Users\Admin\AppData\Local\Temp\payment advice_008900112.exe
"C:\Users\Admin\AppData\Local\Temp\payment advice_008900112.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1400

C:\Users\Admin\AppData\Local\Temp\payment advice_008900112.exe
"C:\Users\Admin\AppData\Local\Temp\payment advice_008900112.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\payment advice_008900112.exe"
3⤵
- Deletes itself
PID:1252

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nstEAFD.tmp\wzqevt.dll
MD5
a776ec55ad876c58677a7fcd8d196f2c

SHA1
108a7314775f38ecc724ed1b01488ee4504f797b

SHA256
072b6796585536a21e8d1815adf43a3047509468ef4b60d55eee335a7136ef04

SHA512
1c1e3a0875c98011fade09a3577b92c7d56ea5497f5b2dcabe736a5ae44512523874129d63a1547fe808741322ae4c29de72b0ecb276fb201e2d75274fffedfb

Download Submit
memory/464-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/464-59-0x00000000008C0000-0x0000000000BC3000-memory.dmp

Filesize
3.0MB

Download
memory/464-60-0x0000000000480000-0x0000000000491000-memory.dmp

Filesize
68KB

Download
memory/1400-54-0x0000000076C91000-0x0000000076C93000-memory.dmp

Filesize
8KB

Download
memory/1400-57-0x0000000002460000-0x00000000030AA000-memory.dmp

Filesize
12.3MB

Download
memory/1408-61-0x0000000006520000-0x00000000065F2000-memory.dmp

Filesize
840KB

Download
memory/1408-67-0x0000000006A40000-0x0000000006B08000-memory.dmp

Filesize
800KB

Download
memory/1480-63-0x0000000000BC0000-0x0000000000BD8000-memory.dmp

Filesize
96KB

Download
memory/1480-64-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/1480-65-0x0000000001FE0000-0x00000000022E3000-memory.dmp

Filesize
3.0MB

Download
memory/1480-66-0x0000000000680000-0x0000000000A91000-memory.dmp

Filesize
4.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads