xloader | b3273dbf7bad4f225c15fbd7728ee709d8ccb1d2e57a3a9942dbc758d2b97c0f

General

Target

Order-807190402-pdf.exe
Size

246KB
MD5

68c5e001f8dae53bce2daf4d5480302a
SHA1

697411019d83f22261b31723f994970c33dc1a20
SHA256

b3273dbf7bad4f225c15fbd7728ee709d8ccb1d2e57a3a9942dbc758d2b97c0f
SHA512

155ff406482ff0273b4eb5a18dfc63e36e9ebb4488224acb3b226a3d042d3266ee71c87784776df8059f69bd32cb98b34a79332bb048ecd5f9f43a4f3591745c

Score

10^/10

xloader uar3 loader persistence rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

uar3

Decoy

sgadvocats.com

mjscannabus.com

hilldaley.com

ksdollhouse.com

hotgiftboutique.com

purebloodsmeet.com

relaunched.info

cap-glove.com

productcollection.store

fulikyy.xyz

remoteaviationjobs.com

bestcleancrystal.com

virtualorganizationpartner.com

bookgocar.com

hattuafhv.quest

makonigroup.com

officecom-myaccount.com

malgorzata-lac.com

e-learningeducators.com

hygilaur.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3948-132-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/308-138-0x0000000002D60000-0x0000000002D89000-memory.dmp	xloader

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Loads dropped DLL 1 IoCs

Processes:

Order-807190402-pdf.exe

pid process

3892 Order-807190402-pdf.exe

pid	process
3892	Order-807190402-pdf.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Order-807190402-pdf.exeOrder-807190402-pdf.execontrol.exe

description	pid	process	target process
PID 3892 set thread context of 3948	3892	Order-807190402-pdf.exe	Order-807190402-pdf.exe
PID 3948 set thread context of 2316	3948	Order-807190402-pdf.exe	Explorer.EXE
PID 308 set thread context of 2316	308	control.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 41 IoCs

Processes:

WaaSMedicAgent.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

Order-807190402-pdf.execontrol.exe

pid	process
3948	Order-807190402-pdf.exe
3948	Order-807190402-pdf.exe
3948	Order-807190402-pdf.exe
3948	Order-807190402-pdf.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe
308	control.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2316 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Order-807190402-pdf.execontrol.exe

pid process

3948 Order-807190402-pdf.exe
3948 Order-807190402-pdf.exe
3948 Order-807190402-pdf.exe
308 control.exe
308 control.exe

pid	process
2316	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Order-807190402-pdf.execontrol.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	3948	Order-807190402-pdf.exe
Token: SeDebugPrivilege	308	control.exe
Token: SeShutdownPrivilege	2316	Explorer.EXE
Token: SeCreatePagefilePrivilege	2316	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Order-807190402-pdf.exeExplorer.EXEcontrol.exe

description	pid	process	target process
PID 3892 wrote to memory of 3948	3892	Order-807190402-pdf.exe	Order-807190402-pdf.exe
PID 3892 wrote to memory of 3948	3892	Order-807190402-pdf.exe	Order-807190402-pdf.exe
PID 3892 wrote to memory of 3948	3892	Order-807190402-pdf.exe	Order-807190402-pdf.exe
PID 3892 wrote to memory of 3948	3892	Order-807190402-pdf.exe	Order-807190402-pdf.exe
PID 3892 wrote to memory of 3948	3892	Order-807190402-pdf.exe	Order-807190402-pdf.exe
PID 3892 wrote to memory of 3948	3892	Order-807190402-pdf.exe	Order-807190402-pdf.exe
PID 2316 wrote to memory of 308	2316	Explorer.EXE	control.exe
PID 2316 wrote to memory of 308	2316	Explorer.EXE	control.exe
PID 2316 wrote to memory of 308	2316	Explorer.EXE	control.exe
PID 308 wrote to memory of 2576	308	control.exe	cmd.exe
PID 308 wrote to memory of 2576	308	control.exe	cmd.exe
PID 308 wrote to memory of 2576	308	control.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316

C:\Users\Admin\AppData\Local\Temp\Order-807190402-pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Order-807190402-pdf.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3892

C:\Users\Admin\AppData\Local\Temp\Order-807190402-pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Order-807190402-pdf.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:308

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Order-807190402-pdf.exe"
3⤵
PID:2576

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 29a126760f77f966c14ec302bd9f0347 kwQiZ2u1hUyAo79KquAR8A.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p
1⤵
PID:3952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsdC785.tmp\pwzcmvmisy.dll
MD5
0379ef9a1abb13b61faddc0ad714ddb7

SHA1
683218b30872825774fcbca3b0f0b3d1f4dfce43

SHA256
de69cf6903ef67081ae40034f5b5c571c2df2fc97606f59259dc6129fcf20c33

SHA512
d5cfd10f449f5311e575e26c6094cb82d48d04bad4bad45beab67b7bd70d91b00bd5e1a053aca0346c9bfde790e7ca712810c3786c8f37498bf245a24c9a4b9d

Download Submit
memory/308-137-0x00000000005A0000-0x00000000005C7000-memory.dmp

Filesize
156KB

Download
memory/308-138-0x0000000002D60000-0x0000000002D89000-memory.dmp

Filesize
164KB

Download
memory/308-139-0x0000000004ED0000-0x000000000521A000-memory.dmp

Filesize
3.3MB

Download
memory/308-140-0x0000000004C70000-0x0000000004D00000-memory.dmp

Filesize
576KB

Download
memory/2316-135-0x00000000012F0000-0x00000000013E7000-memory.dmp

Filesize
988KB

Download
memory/2316-141-0x0000000008550000-0x00000000085E5000-memory.dmp

Filesize
596KB

Download
memory/3892-131-0x00000000022B0000-0x00000000022B2000-memory.dmp

Filesize
8KB

Download
memory/3948-132-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3948-134-0x0000000000770000-0x0000000000D7A000-memory.dmp

Filesize
6.0MB

Download
memory/3948-136-0x00000000006D0000-0x00000000006E1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads