xloader | d9fbe8e59e8dcf5231168ed35a3ad0c8c448eb888eca02c9b898d5961899e839

Analysis

max time kernel
169s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
03/02/2022, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Swift Copy. txt.exe
Size 692KB
Sample220203-mpff3afhb5
SHA256 d9fbe8e59e8dcf5231168ed35a3ad0c8c448eb888eca02c9b898d5961899e839
MD5 b7373ce13b2172f88e17b873d585390c
SHA1 f250238d78386cdc379ca3281dfef2f40b0259fd
SHA512 229266a8cd4de5fd13fd3d7cd05b0e6dbc474939582f76b8972800768b08eb569212b39d9446445da4fb9b89b0f7e14dfcfbebda5031c2d1c218a7cd480eece8
MD5 SHA1 SHA512

Score

10^/10

xloader mwfc loader persistence rat

Malware Config

Extracted

Family

xloader

Version

Campaign

mwfc

Decoy

a-great-intl-voip-phones.zone
police-trust-security.com
415391.com
coi-sl.com
liming-steel.com
criticalracetheoryexplained.com
pintoent.com
columbusrx.com
clarktribe.net
texasforblanchard.com
musical.voyage
priyamblogs.com
employbridge.works
americanchessmaster.com
australiaaddictioncenters.com
drkell-yann.xyz
barryisdaner.com
frankkystein.art
aromatoto7.com
alsuwal.com
dmsolutionsco.com
learnwithvr.net
bigsouthfiresafety.com
atthelastmoment.com
ktnpan.xyz
xinhuishaoyu.com
humanlydivine.com
exitin90.com
wzly.top
blockzcoin.com
edm69.net
bewitchedkit.com
alpeshpate.com
realbeaches.com
bluejaerial.com
amazonjp-securities.net
forbeautii.com
kincsemto.net
playandwin-with-o-tentic.com
herauniversal.com
acs-storage.com
riulaza.com
bedrocksolution.net
xn--latamazulea-beb.com
deniyayatea.com
bubbledenterprise.com
ternopil.agency
freeminingboxes.com
suddennnnnnnnnnnn35.xyz
firstparkcondos.com
starpointeartsacademy.com
3ptsstore.com
cryptocurrencyscamreport.com
helennbendiss47.xyz
intergoldenstateautosales.com
lsmith.xyz
cuantiao.com
xn--z92b76hzfnc1y211an8i78t.com
noon21-203.com
boardsnourhood.com
toddlyonsfishing.com
levancanh.xyz
siteahan.com
winsportgame.club
malagainvestments.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/3308-137-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/2380-143-0x0000000004DC0000-0x0000000004DE9000-memory.dmp	xloader

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 384 set thread context of 3308	384	Swift Copy. txt.exe	69
PID 3308 set thread context of 2428	3308	Swift Copy. txt.exe	13
PID 2380 set thread context of 2428	2380	chkdsk.exe	13

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4040"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132885372714135322"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3308	Swift Copy. txt.exe
3308	Swift Copy. txt.exe
3308	Swift Copy. txt.exe
3308	Swift Copy. txt.exe
2380	chkdsk.exe
2380	chkdsk.exe
2380	chkdsk.exe
2380	chkdsk.exe
2380	chkdsk.exe
2380	chkdsk.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3308	Swift Copy. txt.exe
3308	Swift Copy. txt.exe
3308	Swift Copy. txt.exe
2380	chkdsk.exe
2380	chkdsk.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3308	Swift Copy. txt.exe
Token: SeShutdownPrivilege	2428	Explorer.EXE
Token: SeCreatePagefilePrivilege	2428	Explorer.EXE
Token: SeShutdownPrivilege	2428	Explorer.EXE
Token: SeCreatePagefilePrivilege	2428	Explorer.EXE
Token: SeShutdownPrivilege	2428	Explorer.EXE
Token: SeCreatePagefilePrivilege	2428	Explorer.EXE
Token: SeDebugPrivilege	2380	chkdsk.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 3308	384	Swift Copy. txt.exe	69
PID 384 wrote to memory of 3308	384	Swift Copy. txt.exe	69
PID 384 wrote to memory of 3308	384	Swift Copy. txt.exe	69
PID 384 wrote to memory of 3308	384	Swift Copy. txt.exe	69
PID 384 wrote to memory of 3308	384	Swift Copy. txt.exe	69
PID 384 wrote to memory of 3308	384	Swift Copy. txt.exe	69
PID 2428 wrote to memory of 2380	2428	Explorer.EXE	70
PID 2428 wrote to memory of 2380	2428	Explorer.EXE	70
PID 2428 wrote to memory of 2380	2428	Explorer.EXE	70
PID 2380 wrote to memory of 364	2380	chkdsk.exe	71
PID 2380 wrote to memory of 364	2380	chkdsk.exe	71
PID 2380 wrote to memory of 364	2380	chkdsk.exe	71

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Local\Temp\Swift Copy. txt.exe
  "C:\Users\Admin\AppData\Local\Temp\Swift Copy. txt.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Users\Admin\AppData\Local\Temp\Swift Copy. txt.exe
    "C:\Users\Admin\AppData\Local\Temp\Swift Copy. txt.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- C:\Windows\SysWOW64\chkdsk.exe
  "C:\Windows\SysWOW64\chkdsk.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Swift Copy. txt.exe"
    3⤵
    PID:364

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:2984

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 7018097dcf13a2ad68300657bd4b88c5 HaKo7aV0502PVO7AoYZgMQ.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:2548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-130-0x0000000000A60000-0x0000000000B14000-memory.dmp

Download

memory/384-131-0x0000000005770000-0x0000000005771000-memory.dmp

Download

memory/384-132-0x0000000005780000-0x00000000057C0000-memory.dmp

Download

memory/384-133-0x0000000005950000-0x00000000059E2000-memory.dmp

Download

memory/384-134-0x0000000001500000-0x000000000159C000-memory.dmp

Download

memory/384-135-0x0000000005773000-0x0000000005775000-memory.dmp

Download

memory/384-136-0x00000000061A0000-0x0000000006744000-memory.dmp

Download

memory/2380-143-0x0000000004DC0000-0x0000000004DE9000-memory.dmp

Download

memory/2380-142-0x0000000000A30000-0x0000000000A3A000-memory.dmp

Download

memory/2380-144-0x0000000005790000-0x0000000005ADA000-memory.dmp

Download

memory/2380-145-0x00000000055E0000-0x0000000005670000-memory.dmp

Download

memory/2428-141-0x00000000026C0000-0x0000000002809000-memory.dmp

Download

memory/2428-146-0x0000000002A60000-0x0000000002BD2000-memory.dmp

Download

memory/3308-139-0x00000000013A0000-0x0000000001C1A000-memory.dmp

Download

memory/3308-140-0x0000000001340000-0x0000000001351000-memory.dmp

Download

memory/3308-137-0x0000000000400000-0x0000000000429000-memory.dmp

Download