xloader | 9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e

General

Target

9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe
Size

248KB
MD5

c2ca2ba9c38eb02217588662717ba6c3
SHA1

8a897f24d2e564af2c2fcc272ab0cfbef10611b5
SHA256

9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e
SHA512

7c7a80f37013b8b5fe27e0c9c3144884abde6ca49484c3e8c6cc78daa9f3b6ac890577247223e7d4875b865244e8732840c6a47170fbe2c7f27406ba4c8f52a6

Score

10^/10

xloader b80i loader persistence rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b80i

Decoy

yixuan5.com

jiazheng369.com

danielleefelipe.net

micorgas.com

uvywah.com

nbjcgl.com

streets4suites.com

hempgotas.com

postmoon.xyz

gaboshoes.com

pastodwes.com

libes.asia

damusalama.com

youngliving1.com

mollyagee.com

branchwallet.com

seebuehnegoerlitz.com

inventors.community

teentykarm.quest

927291.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3296-131-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe

pid process

2436 9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe

pid	process
2436	9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe

description	pid	process	target process
PID 2436 set thread context of 3296	2436	9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe	9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 41 IoCs

Processes:

WaaSMedicAgent.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe

pid	process
3296	9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe
3296	9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe

description	pid	process	target process
PID 2436 wrote to memory of 3296	2436	9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe	9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe
PID 2436 wrote to memory of 3296	2436	9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe	9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe
PID 2436 wrote to memory of 3296	2436	9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe	9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe
PID 2436 wrote to memory of 3296	2436	9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe	9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe
PID 2436 wrote to memory of 3296	2436	9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe	9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe
PID 2436 wrote to memory of 3296	2436	9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe	9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe

C:\Users\Admin\AppData\Local\Temp\9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe
"C:\Users\Admin\AppData\Local\Temp\9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2436

C:\Users\Admin\AppData\Local\Temp\9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe
"C:\Users\Admin\AppData\Local\Temp\9af4d9ef8b2a850854ae23411d44d3603147c26898bca1010fd2f9b16f6d456e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3296

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 2fa5c967f1ce28aacf419a7d1978af73 omc2//L2GE+ip2xL58nQkA.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsvA6FD.tmp\npsx.dll
MD5
ff94ac3a49e4c0bcdf0c1fe9730293d9

SHA1
2f81d5b8ec6515fbdfa099eabb0babf9d6c40b97

SHA256
4d2a5f508e4d6a54d71af82fcea978527cdd216423fb050457dfeb4db581178f

SHA512
01f8bc3ac735473c60e842d76d282f4859fd9fecada580bffc629a8127a821a0839ed832143c7034b3a1e3dfca9561841626f0b8fbe582cb6a0e7dab453a5a16

Download Submit
memory/2436-132-0x0000000002280000-0x0000000002284000-memory.dmp

Filesize
16KB

Download
memory/3296-131-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads