xloader | f6322fb68a262178737fa6c63ba5c075c3d78ae0dd5b278326ffcb6f7f3efe59

General

Target

ORDER_71.exe
Size

262KB
MD5

78c4e0ee7d553496e9123839c8fa144c
SHA1

ff5f5c69e406500adff16452c71bf4e0c1322455
SHA256

3c281d772b25ef5bed141574c037855aee8321aec2f3dd272c3526af659795dc
SHA512

832989a7bcbe37d6664934e1d57e95ed55cc8eb635e962bae8070e4bc68f6a4707789105069c2bf8277d1154a0034b7fcf7807c38e66820810e63e5475a948ae

Score

10^/10

xloader uar3 loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

uar3

Decoy

sgadvocats.com

mjscannabus.com

hilldaley.com

ksdollhouse.com

hotgiftboutique.com

purebloodsmeet.com

relaunched.info

cap-glove.com

productcollection.store

fulikyy.xyz

remoteaviationjobs.com

bestcleancrystal.com

virtualorganizationpartner.com

bookgocar.com

hattuafhv.quest

makonigroup.com

officecom-myaccount.com

malgorzata-lac.com

e-learningeducators.com

hygilaur.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2092-118-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/2468-126-0x0000000000A10000-0x0000000000A39000-memory.dmp	xloader

Executes dropped EXE 2 IoCs

Processes:

hfcppzuj.exehfcppzuj.exe

pid process

1904 hfcppzuj.exe
2092 hfcppzuj.exe

pid	process
1904	hfcppzuj.exe
2092	hfcppzuj.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

hfcppzuj.exehfcppzuj.exemstsc.exe

description	pid	process	target process
PID 1904 set thread context of 2092	1904	hfcppzuj.exe	hfcppzuj.exe
PID 2092 set thread context of 3056	2092	hfcppzuj.exe	Explorer.EXE
PID 2468 set thread context of 3056	2468	mstsc.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

hfcppzuj.exemstsc.exe

pid	process
2092	hfcppzuj.exe
2092	hfcppzuj.exe
2092	hfcppzuj.exe
2092	hfcppzuj.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe
2468	mstsc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3056 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

hfcppzuj.exemstsc.exe

pid process

2092 hfcppzuj.exe
2092 hfcppzuj.exe
2092 hfcppzuj.exe
2468 mstsc.exe
2468 mstsc.exe

pid	process
3056	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

hfcppzuj.exemstsc.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	2092	hfcppzuj.exe
Token: SeDebugPrivilege	2468	mstsc.exe
Token: SeShutdownPrivilege	3056	Explorer.EXE
Token: SeCreatePagefilePrivilege	3056	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

ORDER_71.exehfcppzuj.exeExplorer.EXEmstsc.exe

description	pid	process	target process
PID 1628 wrote to memory of 1904	1628	ORDER_71.exe	hfcppzuj.exe
PID 1628 wrote to memory of 1904	1628	ORDER_71.exe	hfcppzuj.exe
PID 1628 wrote to memory of 1904	1628	ORDER_71.exe	hfcppzuj.exe
PID 1904 wrote to memory of 2092	1904	hfcppzuj.exe	hfcppzuj.exe
PID 1904 wrote to memory of 2092	1904	hfcppzuj.exe	hfcppzuj.exe
PID 1904 wrote to memory of 2092	1904	hfcppzuj.exe	hfcppzuj.exe
PID 1904 wrote to memory of 2092	1904	hfcppzuj.exe	hfcppzuj.exe
PID 1904 wrote to memory of 2092	1904	hfcppzuj.exe	hfcppzuj.exe
PID 1904 wrote to memory of 2092	1904	hfcppzuj.exe	hfcppzuj.exe
PID 3056 wrote to memory of 2468	3056	Explorer.EXE	mstsc.exe
PID 3056 wrote to memory of 2468	3056	Explorer.EXE	mstsc.exe
PID 3056 wrote to memory of 2468	3056	Explorer.EXE	mstsc.exe
PID 2468 wrote to memory of 2656	2468	mstsc.exe	cmd.exe
PID 2468 wrote to memory of 2656	2468	mstsc.exe	cmd.exe
PID 2468 wrote to memory of 2656	2468	mstsc.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056

C:\Users\Admin\AppData\Local\Temp\ORDER_71.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER_71.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\Users\Admin\AppData\Local\Temp\hfcppzuj.exe
C:\Users\Admin\AppData\Local\Temp\hfcppzuj.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1904

C:\Users\Admin\AppData\Local\Temp\hfcppzuj.exe
C:\Users\Admin\AppData\Local\Temp\hfcppzuj.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2092

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\hfcppzuj.exe"
3⤵
PID:2656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6iaja8xtuva5dlgmmjc
MD5
c3b88214d035490f382d6647ca213ac6

SHA1
45b0416a531c9a6151042a30540b4477c46942e5

SHA256
5356c21a6a1deaff488ede8c6980f137c7c62bb9b69932bae8878a9ed0e5d544

SHA512
761f0ee4cbca60dc29971bd56fc7bb8e58f27b2b926508e95ad6c123165dd3dadeeded248a940e24877da3af2ee06997a29150321202692fe8364e446acb00d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\cplevtq
MD5
b14b9fbe5cc63338a273c2ad9b4ffe5a

SHA1
b9ea1cf326922d02196bd82bca889082e232a004

SHA256
27d7fc5358df80c0fc40f86c8378242c9465a656bb7925c6d35e2c79144e9a13

SHA512
74066926b21eb5200ec7e5345d29afa453f61cd329331bc1dfbcae1a5c4c2248484854cf66ae3148b1b602ed72c3dfca437913411daf05ef2e24b96e7e890508

Download Submit
C:\Users\Admin\AppData\Local\Temp\hfcppzuj.exe
MD5
26e62de1fe0425c1d68603a6a4b01e9a

SHA1
a33d313b71cde30b9ed98e05ca730af8c1bd866c

SHA256
ec520fe2a81e72ce6b55eff28f6ff1034472033c1e3bff24227a3feacb53c1c4

SHA512
600d3656cd55caa2b7089fcbd51c1fc8a8155c8f4aab0157ac701be8c922b804da725142faffdb1a03929adb2242ee132fe24b3b9a35be735f1fddcd7f9374a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\hfcppzuj.exe
MD5
26e62de1fe0425c1d68603a6a4b01e9a

SHA1
a33d313b71cde30b9ed98e05ca730af8c1bd866c

SHA256
ec520fe2a81e72ce6b55eff28f6ff1034472033c1e3bff24227a3feacb53c1c4

SHA512
600d3656cd55caa2b7089fcbd51c1fc8a8155c8f4aab0157ac701be8c922b804da725142faffdb1a03929adb2242ee132fe24b3b9a35be735f1fddcd7f9374a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\hfcppzuj.exe
MD5
26e62de1fe0425c1d68603a6a4b01e9a

SHA1
a33d313b71cde30b9ed98e05ca730af8c1bd866c

SHA256
ec520fe2a81e72ce6b55eff28f6ff1034472033c1e3bff24227a3feacb53c1c4

SHA512
600d3656cd55caa2b7089fcbd51c1fc8a8155c8f4aab0157ac701be8c922b804da725142faffdb1a03929adb2242ee132fe24b3b9a35be735f1fddcd7f9374a5

Download Submit
memory/2092-120-0x0000000000A30000-0x0000000000D50000-memory.dmp

Filesize
3.1MB

Download
memory/2092-118-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2092-122-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/2092-123-0x00000000009D0000-0x00000000009E1000-memory.dmp

Filesize
68KB

Download
memory/2468-125-0x0000000000ED0000-0x00000000011CC000-memory.dmp

Filesize
3.0MB

Download
memory/2468-126-0x0000000000A10000-0x0000000000A39000-memory.dmp

Filesize
164KB

Download
memory/2468-127-0x0000000004E00000-0x0000000005120000-memory.dmp

Filesize
3.1MB

Download
memory/2468-128-0x0000000004B70000-0x0000000004C00000-memory.dmp

Filesize
576KB

Download
memory/3056-124-0x0000000005E70000-0x0000000006016000-memory.dmp

Filesize
1.6MB

Download
memory/3056-129-0x0000000002910000-0x00000000029DD000-memory.dmp

Filesize
820KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads