xloader | 3d0defc77abb415c8854149e73e067b94bdb3fdc638fa7e104bcc4a325dc658a

Analysis

max time kernel
180s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
10/02/2022, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92f6235668a7c0e38d874204e701f558.exe
Size 296KB
Sample220210-jfwvxagcb7
SHA256 3d0defc77abb415c8854149e73e067b94bdb3fdc638fa7e104bcc4a325dc658a
MD5 92f6235668a7c0e38d874204e701f558
SHA1 bc93ea792a88b2be1af2b974bce9981316f1a986
SHA512 8e6285c08f10f203cd5d642f79ca87a15945485e9a288c1fbda4f36442a1a1f1ba667b3083d5841743be5692d28c944c71651c37ade8572ecc7272c72e13d1dc
MD5 SHA1 SHA512

Score

10^/10

xloader t9hh loader persistence rat

Malware Config

Extracted

Family

xloader

Version

Campaign

t9hh

Decoy

mine.vin
terpenebase.com
potomarket.com
lmaproshop.com
multitecsd.com
vacationrentalsct.com
france-gravure.com
schoolq8.com
caravan777.com
mimtgexpert.com
animesomurie.com
buscalogps.online
legionstudio.net
pdam.top
galapaleso.quest
gulfweeks.com
sedonasuperfit.online
arab-xt-pro.com
fifeapartment.com
pitchgiving.com
ebonyassworship.com
rrrl.space
souscription-ingdiba-ag.com
778tt8.com
karistell.com
novasaudeg1.online
nobis.care
weirdwoman.info
pet-field.com
vnpt66-it.com
manyi-pcsc.biz
bodillion.com
ishirmansingh.com
arrowsmarthr.net
waszom.com
boundlessbeliefs.com
sangs.info
encominate.com
bellesonbroadway.net
golfbombs.store
themerchplug.com
garethjame.biz
lamaisondesmamans.com
gutimautpribuinropgroup.com
kurzundklar.com
pinpointmarket.com
royalprestigehospitality.com
dunnfamily.party
nystmail.com
pconsciousness.com
matranutricion.com
themagneticpro.com
earches3.com
lostformailtoyof2.xyz
battletabs.xyz
spotondigitalsolutions.com
blinglj.com
priceonpole.com
dobsonfryedentist.com
maktabeahlesunnat.com
mcr-llc.com
lens-experts.com
thgn38.xyz
mciedalu.com
stichmarketing.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/900-134-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/2796-142-0x0000000000130000-0x0000000000159000-memory.dmp	xloader

Executes dropped EXE 2 IoCs

pid	Process
2800	qgtlszcr.exe
900	qgtlszcr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\phmcvdhckr = "C:\\Users\\Admin\\AppData\\Roaming\\osptfsighv\\qiiuqwlkxmk.exe"	qgtlszcr.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2800 set thread context of 900	2800	qgtlszcr.exe	66
PID 900 set thread context of 2416	900	qgtlszcr.exe	11
PID 2796 set thread context of 2416	2796	help.exe	11

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "1.583736"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132891290871529414"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4032"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
900	qgtlszcr.exe
900	qgtlszcr.exe
900	qgtlszcr.exe
900	qgtlszcr.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe
2796	help.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2416	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
900	qgtlszcr.exe
900	qgtlszcr.exe
900	qgtlszcr.exe
2796	help.exe
2796	help.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	qgtlszcr.exe
Token: SeDebugPrivilege	2796	help.exe
Token: SeShutdownPrivilege	2416	Explorer.EXE
Token: SeCreatePagefilePrivilege	2416	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 2800	3320	92f6235668a7c0e38d874204e701f558.exe	64
PID 3320 wrote to memory of 2800	3320	92f6235668a7c0e38d874204e701f558.exe	64
PID 3320 wrote to memory of 2800	3320	92f6235668a7c0e38d874204e701f558.exe	64
PID 2800 wrote to memory of 900	2800	qgtlszcr.exe	66
PID 2800 wrote to memory of 900	2800	qgtlszcr.exe	66
PID 2800 wrote to memory of 900	2800	qgtlszcr.exe	66
PID 2800 wrote to memory of 900	2800	qgtlszcr.exe	66
PID 2800 wrote to memory of 900	2800	qgtlszcr.exe	66
PID 2800 wrote to memory of 900	2800	qgtlszcr.exe	66
PID 2416 wrote to memory of 2796	2416	Explorer.EXE	68
PID 2416 wrote to memory of 2796	2416	Explorer.EXE	68
PID 2416 wrote to memory of 2796	2416	Explorer.EXE	68

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\92f6235668a7c0e38d874204e701f558.exe
  "C:\Users\Admin\AppData\Local\Temp\92f6235668a7c0e38d874204e701f558.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Users\Admin\AppData\Local\Temp\qgtlszcr.exe
    C:\Users\Admin\AppData\Local\Temp\qgtlszcr.exe C:\Users\Admin\AppData\Local\Temp\ztxwwxamk
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\qgtlszcr.exe
      C:\Users\Admin\AppData\Local\Temp\qgtlszcr.exe C:\Users\Admin\AppData\Local\Temp\ztxwwxamk
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:900
- C:\Windows\SysWOW64\help.exe
  "C:\Windows\SysWOW64\help.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:2796

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:1540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-136-0x0000000001910000-0x0000000001C5A000-memory.dmp

Download

memory/900-134-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/900-138-0x000000000041D000-0x000000000041E000-memory.dmp

Download

memory/900-139-0x0000000001450000-0x0000000001461000-memory.dmp

Download

memory/2416-140-0x0000000008690000-0x0000000008815000-memory.dmp

Download

memory/2416-145-0x0000000008930000-0x0000000008A22000-memory.dmp

Download

memory/2796-141-0x0000000000FC0000-0x0000000000FC7000-memory.dmp

Download

memory/2796-142-0x0000000000130000-0x0000000000159000-memory.dmp

Download

memory/2796-143-0x0000000000A60000-0x0000000000DAA000-memory.dmp

Download

memory/2796-144-0x0000000000880000-0x0000000000910000-memory.dmp

Download