xloader | 547b0c2f7b3ee0275ff34781d0fa579a07d437629c9ee5e81d8782bb7e12dc4e

Analysis

max time kernel
154s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
31/01/2022, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Page-1029382393.exe
Size 480KB
Sample220131-pdrq3ahbbk
SHA256 547b0c2f7b3ee0275ff34781d0fa579a07d437629c9ee5e81d8782bb7e12dc4e
MD5 2d6983ca4172cd59f90949443d4b5596
SHA1 06ec7184a82223036b85743cdf988f2166fbb4c7
SHA512 541fc96ee9d4727a2c0980c8553a54285cc511cf3298d5ca07f53340a0e2da493324aead0035433b9bf4fc31cb646de7127921f02e4a4fb334dfc87999859024
MD5 SHA1 SHA512

Score

10^/10

xloader c6si loader persistence rat suricata

Malware Config

Extracted

Family

xloader

Version

Campaign

c6si

Decoy

tristateinc.construction
americanscaregroundstexas.com
kanimisoshiru.com
wihling.com
fishcheekstosa.com
parentsfuid.com
greenstandmarket.com
fc8fla8kzq.com
gametwist-83.club
jobsncvs.com
directrealtysells.com
avida2015.com
conceptasite.net
arkaneattire.com
indev-mobility.info
2160centurypark412.com
valefloor.com
septembership.com
stackflix.com
jimc0sales.net
socialviralup.com
lastra41.com
juliaepaulovaocasar.com
jurisagora.com
drawandgrow.online
rebekahlouise.com
herport-fr.com
iphone13.webcam
appz-one.net
inpost-pl.net
promocion360fitness.com
global-forbes.biz
diamondtrade.net
albertcantos.com
gtgits.com
travel-ai.online
busipe6.com
mualikesubvn.com
niftyhandy.com
docprops.com
lido88.bet
baywoodphotography.com
cargosouq.info
newsnowlive.online
floridafishingoverboard.com
missnikissalsa.net
walletvalidate.space
kissimmeeinternationalcup.com
charterhome.school
gurujupiter.com
entertainmentwitchy.com
jokeaou.com
sugarmountainfirearms.com
iss-sa.com
smittyssierra.com
freedomoff.com
giftoin.com
realitystararmwrestling.com
salsalunch-equallyage.com
ladouba.com
thepropertygoat.com
bestofmerrick.guide
4the.top
regioinversiones.com
129qihu.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/4012-135-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/3064-141-0x0000000002A00000-0x0000000002A29000-memory.dmp	xloader

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3460 set thread context of 4012	3460	Page-1029382393.exe	66
PID 4012 set thread context of 2496	4012	Page-1029382393.exe	28
PID 3064 set thread context of 2496	3064	svchost.exe	28

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
3460	Page-1029382393.exe
3460	Page-1029382393.exe
4012	Page-1029382393.exe
4012	Page-1029382393.exe
4012	Page-1029382393.exe
4012	Page-1029382393.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2496	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4012	Page-1029382393.exe
4012	Page-1029382393.exe
4012	Page-1029382393.exe
3064	svchost.exe
3064	svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3460	Page-1029382393.exe
Token: SeDebugPrivilege	4012	Page-1029382393.exe
Token: SeDebugPrivilege	3064	svchost.exe
Token: SeShutdownPrivilege	2496	Explorer.EXE
Token: SeCreatePagefilePrivilege	2496	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2496	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 3996	3460	Page-1029382393.exe	65
PID 3460 wrote to memory of 3996	3460	Page-1029382393.exe	65
PID 3460 wrote to memory of 3996	3460	Page-1029382393.exe	65
PID 3460 wrote to memory of 4012	3460	Page-1029382393.exe	66
PID 3460 wrote to memory of 4012	3460	Page-1029382393.exe	66
PID 3460 wrote to memory of 4012	3460	Page-1029382393.exe	66
PID 3460 wrote to memory of 4012	3460	Page-1029382393.exe	66
PID 3460 wrote to memory of 4012	3460	Page-1029382393.exe	66
PID 3460 wrote to memory of 4012	3460	Page-1029382393.exe	66
PID 2496 wrote to memory of 3064	2496	Explorer.EXE	72
PID 2496 wrote to memory of 3064	2496	Explorer.EXE	72
PID 2496 wrote to memory of 3064	2496	Explorer.EXE	72
PID 3064 wrote to memory of 3280	3064	svchost.exe	73
PID 3064 wrote to memory of 3280	3064	svchost.exe	73
PID 3064 wrote to memory of 3280	3064	svchost.exe	73

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe
  "C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe
    "C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe"
    3⤵
    PID:3996
- - C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe
    "C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:4012
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2980
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:3904
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2512
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:3988
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2236
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe"
    3⤵
    PID:3280

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 9b14c63fb9e1f62b7ecfaf63eeefabf6 nHwbbKrc90q5AA2t+qJTRQ.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:1908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1⤵
PID:2324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-139-0x00000000093F0000-0x00000000094EF000-memory.dmp

Download

memory/2496-144-0x0000000008DD0000-0x0000000008E71000-memory.dmp

Download

memory/3064-143-0x0000000003100000-0x0000000003190000-memory.dmp

Download

memory/3064-142-0x0000000003500000-0x000000000384A000-memory.dmp

Download

memory/3064-141-0x0000000002A00000-0x0000000002A29000-memory.dmp

Download

memory/3064-140-0x00000000000F0000-0x00000000000FE000-memory.dmp

Download

memory/3460-133-0x0000000005010000-0x00000000050AC000-memory.dmp

Download

memory/3460-134-0x00000000059B0000-0x0000000005F54000-memory.dmp

Download

memory/3460-130-0x00000000000F0000-0x000000000016E000-memory.dmp

Download

memory/3460-132-0x0000000004CD0000-0x0000000004D62000-memory.dmp

Download

memory/3460-131-0x0000000004A70000-0x0000000004A71000-memory.dmp

Download

memory/4012-137-0x0000000001500000-0x0000000001C9A000-memory.dmp

Download

memory/4012-138-0x0000000001500000-0x0000000001C9A000-memory.dmp

Download

memory/4012-135-0x0000000000400000-0x0000000000429000-memory.dmp

Download