xloader | 547b0c2f7b3ee0275ff34781d0fa579a07d437629c9ee5e81d8782bb7e12dc4e

General

Target

Page-1029382393.exe
Size

480KB
MD5

2d6983ca4172cd59f90949443d4b5596
SHA1

06ec7184a82223036b85743cdf988f2166fbb4c7
SHA256

547b0c2f7b3ee0275ff34781d0fa579a07d437629c9ee5e81d8782bb7e12dc4e
SHA512

541fc96ee9d4727a2c0980c8553a54285cc511cf3298d5ca07f53340a0e2da493324aead0035433b9bf4fc31cb646de7127921f02e4a4fb334dfc87999859024

Score

10^/10

xloader c6si loader persistence rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

c6si

Decoy

tristateinc.construction

americanscaregroundstexas.com

kanimisoshiru.com

wihling.com

fishcheekstosa.com

parentsfuid.com

greenstandmarket.com

fc8fla8kzq.com

gametwist-83.club

jobsncvs.com

directrealtysells.com

avida2015.com

conceptasite.net

arkaneattire.com

indev-mobility.info

2160centurypark412.com

valefloor.com

septembership.com

stackflix.com

jimc0sales.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4012-135-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/3064-141-0x0000000002A00000-0x0000000002A29000-memory.dmp	xloader

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Suspicious use of SetThreadContext 3 IoCs

Processes:

Page-1029382393.exePage-1029382393.exesvchost.exe

description	pid	process	target process
PID 3460 set thread context of 4012	3460	Page-1029382393.exe	Page-1029382393.exe
PID 4012 set thread context of 2496	4012	Page-1029382393.exe	Explorer.EXE
PID 3064 set thread context of 2496	3064	svchost.exe	Explorer.EXE

Modifies data under HKEY_USERS 41 IoCs

Processes:

WaaSMedicAgent.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

Processes:

Page-1029382393.exePage-1029382393.exesvchost.exe

pid	process
3460	Page-1029382393.exe
3460	Page-1029382393.exe
4012	Page-1029382393.exe
4012	Page-1029382393.exe
4012	Page-1029382393.exe
4012	Page-1029382393.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe
3064	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2496 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Page-1029382393.exesvchost.exe

pid process

4012 Page-1029382393.exe
4012 Page-1029382393.exe
4012 Page-1029382393.exe
3064 svchost.exe
3064 svchost.exe

pid	process
2496	Explorer.EXE

pid	process
4012	Page-1029382393.exe
4012	Page-1029382393.exe
4012	Page-1029382393.exe
3064	svchost.exe
3064	svchost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

Page-1029382393.exePage-1029382393.exesvchost.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	3460	Page-1029382393.exe
Token: SeDebugPrivilege	4012	Page-1029382393.exe
Token: SeDebugPrivilege	3064	svchost.exe
Token: SeShutdownPrivilege	2496	Explorer.EXE
Token: SeCreatePagefilePrivilege	2496	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

2496 Explorer.EXE

pid	process
2496	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Page-1029382393.exeExplorer.EXEsvchost.exe

description	pid	process	target process
PID 3460 wrote to memory of 3996	3460	Page-1029382393.exe	Page-1029382393.exe
PID 3460 wrote to memory of 3996	3460	Page-1029382393.exe	Page-1029382393.exe
PID 3460 wrote to memory of 3996	3460	Page-1029382393.exe	Page-1029382393.exe
PID 3460 wrote to memory of 4012	3460	Page-1029382393.exe	Page-1029382393.exe
PID 3460 wrote to memory of 4012	3460	Page-1029382393.exe	Page-1029382393.exe
PID 3460 wrote to memory of 4012	3460	Page-1029382393.exe	Page-1029382393.exe
PID 3460 wrote to memory of 4012	3460	Page-1029382393.exe	Page-1029382393.exe
PID 3460 wrote to memory of 4012	3460	Page-1029382393.exe	Page-1029382393.exe
PID 3460 wrote to memory of 4012	3460	Page-1029382393.exe	Page-1029382393.exe
PID 2496 wrote to memory of 3064	2496	Explorer.EXE	svchost.exe
PID 2496 wrote to memory of 3064	2496	Explorer.EXE	svchost.exe
PID 2496 wrote to memory of 3064	2496	Explorer.EXE	svchost.exe
PID 3064 wrote to memory of 3280	3064	svchost.exe	cmd.exe
PID 3064 wrote to memory of 3280	3064	svchost.exe	cmd.exe
PID 3064 wrote to memory of 3280	3064	svchost.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2496

C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe
"C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460

C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe
"C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe"
3⤵
PID:3996

C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe
"C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4012

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2980

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:3904

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2512

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:3988

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2236

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Page-1029382393.exe"
3⤵
PID:3280

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 9b14c63fb9e1f62b7ecfaf63eeefabf6 nHwbbKrc90q5AA2t+qJTRQ.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:1908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
1⤵
PID:2324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-139-0x00000000093F0000-0x00000000094EF000-memory.dmp

Filesize
1020KB

Download
memory/2496-144-0x0000000008DD0000-0x0000000008E71000-memory.dmp

Filesize
644KB

Download
memory/3064-143-0x0000000003100000-0x0000000003190000-memory.dmp

Filesize
576KB

Download
memory/3064-142-0x0000000003500000-0x000000000384A000-memory.dmp

Filesize
3.3MB

Download
memory/3064-141-0x0000000002A00000-0x0000000002A29000-memory.dmp

Filesize
164KB

Download
memory/3064-140-0x00000000000F0000-0x00000000000FE000-memory.dmp

Filesize
56KB

Download
memory/3460-133-0x0000000005010000-0x00000000050AC000-memory.dmp

Filesize
624KB

Download
memory/3460-134-0x00000000059B0000-0x0000000005F54000-memory.dmp

Filesize
5.6MB

Download
memory/3460-130-0x00000000000F0000-0x000000000016E000-memory.dmp

Filesize
504KB

Download
memory/3460-132-0x0000000004CD0000-0x0000000004D62000-memory.dmp

Filesize
584KB

Download
memory/3460-131-0x0000000004A70000-0x0000000004A71000-memory.dmp

Filesize
4KB

Download
memory/4012-137-0x0000000001500000-0x0000000001C9A000-memory.dmp

Filesize
7.6MB

Download
memory/4012-138-0x0000000001500000-0x0000000001C9A000-memory.dmp

Filesize
7.6MB

Download
memory/4012-135-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads