xloader | ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af

General

Target

ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe
Size

381KB
MD5

45e5dea524b2d42e2f1fd24ee1bd18de
SHA1

35041d4b682b60813c07ec4a1551a51090d075aa
SHA256

ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af
SHA512

2291aaf9080b2ebf668eab6cec31b0b79ec0a73099d58776dca5110585b666c39003f387a525ac4861a047d733d22f6e8c0d33d6344c3b5b372ad32669a7eb2c

Score

10^/10

xloader nt3f loader persistence rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

nt3f

Decoy

tricyclee.com

kxsw999.com

wisteria-pavilion.com

bellaclancy.com

promissioskincare.com

hzy001.xyz

checkouthomehd.com

soladere.com

point4sales.com

socalmafia.com

libertadysarmiento.online

nftthirty.com

digitalgoldcryptostock.net

tulekiloscaird.com

austinfishandchicken.com

wlxxch.com

mgav51.xyz

landbanking.global

saprove.com

babyfaces.skin

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3628-140-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe

description	pid	process	target process
PID 3576 set thread context of 3628	3576	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1140 schtasks.exe

pid	process
1140	schtasks.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

WaaSMedicAgent.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exepowershell.exe

pid	process
3628	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe
3628	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe
2876	powershell.exe
2876	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2876 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2876	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe

description	pid	process	target process
PID 3576 wrote to memory of 2876	3576	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe	powershell.exe
PID 3576 wrote to memory of 2876	3576	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe	powershell.exe
PID 3576 wrote to memory of 2876	3576	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe	powershell.exe
PID 3576 wrote to memory of 1140	3576	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe	schtasks.exe
PID 3576 wrote to memory of 1140	3576	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe	schtasks.exe
PID 3576 wrote to memory of 1140	3576	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe	schtasks.exe
PID 3576 wrote to memory of 3628	3576	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe
PID 3576 wrote to memory of 3628	3576	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe
PID 3576 wrote to memory of 3628	3576	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe
PID 3576 wrote to memory of 3628	3576	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe
PID 3576 wrote to memory of 3628	3576	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe
PID 3576 wrote to memory of 3628	3576	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe	ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe

C:\Users\Admin\AppData\Local\Temp\ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe
"C:\Users\Admin\AppData\Local\Temp\ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3576

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aIHSuXuCdpyZ.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aIHSuXuCdpyZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF0D1.tmp"
2⤵
- Creates scheduled task(s)
PID:1140

C:\Users\Admin\AppData\Local\Temp\ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe
"C:\Users\Admin\AppData\Local\Temp\ae89b5ad57da10b0c320c7ec489f66cd5e5888458d9dd8430d438df4a68456af.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1⤵
PID:2992

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 4441fc86146f93b7d685f5e5b24ec13f WLr3o4/L+0um6ICgNSuhXw.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:3836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF0D1.tmp
MD5
99b8b43b9132d7bc30ddf370d6c21ff2

SHA1
8dacd73f33d5b2a6cfa18409e9c3ec0327a16bb1

SHA256
806c809fa9fb7ff8e09664df1046411bd6ad80799cc17cd0b019c7a5b761ccdb

SHA512
c930109756317b67cd09484902e610827219be54c6458f38541bf2d7237652c51ca0b4655052432db932d01abbe94669e04a86950b53b67997bf657e769428e9

Download Submit
memory/2876-146-0x00000000077F0000-0x0000000007856000-memory.dmp

Filesize
408KB

Download
memory/2876-152-0x000000007FB50000-0x000000007FB51000-memory.dmp

Filesize
4KB

Download
memory/2876-145-0x00000000075D0000-0x0000000007636000-memory.dmp

Filesize
408KB

Download
memory/2876-158-0x0000000009AD0000-0x0000000009AEA000-memory.dmp

Filesize
104KB

Download
memory/2876-157-0x00000000099C0000-0x00000000099CE000-memory.dmp

Filesize
56KB

Download
memory/2876-138-0x0000000004B40000-0x0000000004B76000-memory.dmp

Filesize
216KB

Download
memory/2876-156-0x0000000009A10000-0x0000000009AA6000-memory.dmp

Filesize
600KB

Download
memory/2876-155-0x0000000009800000-0x000000000980A000-memory.dmp

Filesize
40KB

Download
memory/2876-142-0x00000000078B0000-0x0000000007ED8000-memory.dmp

Filesize
6.2MB

Download
memory/2876-141-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/2876-143-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/2876-144-0x00000000073B0000-0x00000000073D2000-memory.dmp

Filesize
136KB

Download
memory/2876-147-0x0000000008480000-0x000000000849E000-memory.dmp

Filesize
120KB

Download
memory/2876-159-0x0000000009AB0000-0x0000000009AB8000-memory.dmp

Filesize
32KB

Download
memory/2876-154-0x0000000009790000-0x00000000097AA000-memory.dmp

Filesize
104KB

Download
memory/2876-148-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/2876-149-0x0000000008A50000-0x0000000008A82000-memory.dmp

Filesize
200KB

Download
memory/2876-150-0x0000000071840000-0x000000007188C000-memory.dmp

Filesize
304KB

Download
memory/2876-151-0x0000000008A30000-0x0000000008A4E000-memory.dmp

Filesize
120KB

Download
memory/2876-153-0x0000000009DD0000-0x000000000A44A000-memory.dmp

Filesize
6.5MB

Download
memory/3576-132-0x0000000004C80000-0x0000000004D12000-memory.dmp

Filesize
584KB

Download
memory/3576-133-0x0000000004C80000-0x0000000005224000-memory.dmp

Filesize
5.6MB

Download
memory/3576-131-0x0000000005230000-0x00000000057D4000-memory.dmp

Filesize
5.6MB

Download
memory/3576-135-0x0000000007060000-0x00000000070FC000-memory.dmp

Filesize
624KB

Download
memory/3576-134-0x0000000004C60000-0x0000000004C6A000-memory.dmp

Filesize
40KB

Download
memory/3576-130-0x0000000000250000-0x00000000002B6000-memory.dmp

Filesize
408KB

Download
memory/3628-140-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads