xloader | 6e6e18a85c523bfffd1b5293b978832f7387fda9b9eee87d3d8e98666fe020c9

General

Target

win32.exe
Size

656KB
MD5

ada88465652140cfa9ae8955370fc40f
SHA1

e13c0564f3662230c11537366d1568c5c3825513
SHA256

6e6e18a85c523bfffd1b5293b978832f7387fda9b9eee87d3d8e98666fe020c9
SHA512

2e288e1d465c0babe87f52417dea9822dafe0aa21448468c2a38c1d72e9b933ed38b06a1cb1a0ea34ac9100b8faa9603117f01697c22c0ab25156787cb8ca51f

Score

10^/10

xloader w6ot loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

w6ot

Decoy

zerodawnprime.com

chunhejingming.com

estrellafiamma.biz

meetbotique.com

westernghatsstudyabroad.com

madysenlenihancoaching.com

c2batlrjm05uzzjnamm8627.com

sasamamai.com

softcherry.club

iputtbetter.store

sointuboete.quest

mahadevwardrobe.online

goedkope-ladegeleiders.online

g3taquotea.info

987vna.club

justdodge.net

b95202.com

dwabiegunyfotografii.com

entrustqlxorx.online

busineschatcom.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1604-134-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/1604-144-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/1568-149-0x0000000000DA0000-0x0000000000DC9000-memory.dmp	xloader

Executes dropped EXE 2 IoCs

Processes:

xcsjhnbx.exexcsjhnbx.exe

pid process

768 xcsjhnbx.exe
1604 xcsjhnbx.exe

pid	process
768	xcsjhnbx.exe
1604	xcsjhnbx.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

xcsjhnbx.exexcsjhnbx.exemsdt.exe

description	pid	process	target process
PID 768 set thread context of 1604	768	xcsjhnbx.exe	xcsjhnbx.exe
PID 1604 set thread context of 3024	1604	xcsjhnbx.exe	Explorer.EXE
PID 1604 set thread context of 3024	1604	xcsjhnbx.exe	Explorer.EXE
PID 1568 set thread context of 3024	1568	msdt.exe	Explorer.EXE

Drops file in Windows directory 8 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

xcsjhnbx.exemsdt.exe

pid	process
1604	xcsjhnbx.exe
1604	xcsjhnbx.exe
1604	xcsjhnbx.exe
1604	xcsjhnbx.exe
1604	xcsjhnbx.exe
1604	xcsjhnbx.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe
1568	msdt.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3024 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

xcsjhnbx.exemsdt.exe

pid process

1604 xcsjhnbx.exe
1604 xcsjhnbx.exe
1604 xcsjhnbx.exe
1604 xcsjhnbx.exe
1568 msdt.exe
1568 msdt.exe

pid	process
3024	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

xcsjhnbx.exesvchost.exemsdt.exeTiWorker.exe

description	pid	process
Token: SeDebugPrivilege	1604	xcsjhnbx.exe
Token: SeShutdownPrivilege	4380	svchost.exe
Token: SeCreatePagefilePrivilege	4380	svchost.exe
Token: SeShutdownPrivilege	4380	svchost.exe
Token: SeCreatePagefilePrivilege	4380	svchost.exe
Token: SeShutdownPrivilege	4380	svchost.exe
Token: SeCreatePagefilePrivilege	4380	svchost.exe
Token: SeDebugPrivilege	1568	msdt.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe
Token: SeSecurityPrivilege	1332	TiWorker.exe
Token: SeBackupPrivilege	1332	TiWorker.exe
Token: SeRestorePrivilege	1332	TiWorker.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

win32.exexcsjhnbx.exeExplorer.EXEmsdt.exe

description	pid	process	target process
PID 2772 wrote to memory of 768	2772	win32.exe	xcsjhnbx.exe
PID 2772 wrote to memory of 768	2772	win32.exe	xcsjhnbx.exe
PID 2772 wrote to memory of 768	2772	win32.exe	xcsjhnbx.exe
PID 768 wrote to memory of 1604	768	xcsjhnbx.exe	xcsjhnbx.exe
PID 768 wrote to memory of 1604	768	xcsjhnbx.exe	xcsjhnbx.exe
PID 768 wrote to memory of 1604	768	xcsjhnbx.exe	xcsjhnbx.exe
PID 768 wrote to memory of 1604	768	xcsjhnbx.exe	xcsjhnbx.exe
PID 768 wrote to memory of 1604	768	xcsjhnbx.exe	xcsjhnbx.exe
PID 768 wrote to memory of 1604	768	xcsjhnbx.exe	xcsjhnbx.exe
PID 3024 wrote to memory of 1568	3024	Explorer.EXE	msdt.exe
PID 3024 wrote to memory of 1568	3024	Explorer.EXE	msdt.exe
PID 3024 wrote to memory of 1568	3024	Explorer.EXE	msdt.exe
PID 1568 wrote to memory of 3512	1568	msdt.exe	cmd.exe
PID 1568 wrote to memory of 3512	1568	msdt.exe	cmd.exe
PID 1568 wrote to memory of 3512	1568	msdt.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3024

C:\Users\Admin\AppData\Local\Temp\win32.exe
"C:\Users\Admin\AppData\Local\Temp\win32.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2772

C:\Users\Admin\AppData\Local\Temp\xcsjhnbx.exe
C:\Users\Admin\AppData\Local\Temp\xcsjhnbx.exe C:\Users\Admin\AppData\Local\Temp\klsqys
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:768

C:\Users\Admin\AppData\Local\Temp\xcsjhnbx.exe
C:\Users\Admin\AppData\Local\Temp\xcsjhnbx.exe C:\Users\Admin\AppData\Local\Temp\klsqys
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1604

C:\Windows\SysWOW64\msdt.exe
"C:\Windows\SysWOW64\msdt.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\xcsjhnbx.exe"
3⤵
PID:3512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\klsqys

MD5
74894acf2f92497a4112350086628a69

SHA1
d89bbaa9815a9dab1bb78b9caa0e59102af14007

SHA256
ed3cd1384a99d8bf6689d7da1da1caeec9aca71f969da688bbe8c4207128a813

SHA512
cdd4452e2b23be76d3fbebd1433d59142a5559bdc4aa34dd9c173251f98da02ccbfa9e9319a2ada9b58dcbce5c470edbf75a25f0cf5b13eb071b758befb6573c

Download Submit
C:\Users\Admin\AppData\Local\Temp\md3vfbdcdvnfqyw4m

MD5
6f9be1ba8b37123e0fac76fa9efab260

SHA1
8eedb1159c8b44333a9d46502405458ed798bce6

SHA256
59c3e8cf49539188344653ce44a43b1138b27fd31ad375bb90f87a41a73abd67

SHA512
c999becfaf06c51e44f63b752d8e7bc0496d8e24233a858af016234dd0357e8d4c90d78ffb9b49f6e4849480bb4215f19f0aa835e527fd5db35ce97fd6876e9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\xcsjhnbx.exe

MD5
faac8659b70789bbc4d0bf78dc566fad

SHA1
ffa98396d0a61efa1ed7213b74c2c8e05a97c40f

SHA256
2a53b351cb91b40c76c2cf95f7cd43650b355fbf77bbe9e249c136367181140b

SHA512
46e62ba555f1eae412f6a304d013897699412d8555137812de24928a236c49f6e4c33096499d1824c68097d9cc88853c786c2afd6ad6dbe34ab3acf0d81b3049

Download Submit
C:\Users\Admin\AppData\Local\Temp\xcsjhnbx.exe

MD5
faac8659b70789bbc4d0bf78dc566fad

SHA1
ffa98396d0a61efa1ed7213b74c2c8e05a97c40f

SHA256
2a53b351cb91b40c76c2cf95f7cd43650b355fbf77bbe9e249c136367181140b

SHA512
46e62ba555f1eae412f6a304d013897699412d8555137812de24928a236c49f6e4c33096499d1824c68097d9cc88853c786c2afd6ad6dbe34ab3acf0d81b3049

Download Submit
C:\Users\Admin\AppData\Local\Temp\xcsjhnbx.exe

MD5
faac8659b70789bbc4d0bf78dc566fad

SHA1
ffa98396d0a61efa1ed7213b74c2c8e05a97c40f

SHA256
2a53b351cb91b40c76c2cf95f7cd43650b355fbf77bbe9e249c136367181140b

SHA512
46e62ba555f1eae412f6a304d013897699412d8555137812de24928a236c49f6e4c33096499d1824c68097d9cc88853c786c2afd6ad6dbe34ab3acf0d81b3049

Download Submit
memory/1568-151-0x0000000002D50000-0x0000000002DE0000-memory.dmp

Filesize
576KB

Download
memory/1568-150-0x00000000031D0000-0x000000000351A000-memory.dmp

Filesize
3.3MB

Download
memory/1568-149-0x0000000000DA0000-0x0000000000DC9000-memory.dmp

Filesize
164KB

Download
memory/1568-148-0x00000000009E0000-0x0000000000A37000-memory.dmp

Filesize
348KB

Download
memory/1604-146-0x0000000001BF0000-0x0000000001C01000-memory.dmp

Filesize
68KB

Download
memory/1604-144-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1604-145-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/1604-138-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/1604-139-0x0000000001710000-0x0000000001721000-memory.dmp

Filesize
68KB

Download
memory/1604-136-0x0000000001770000-0x0000000001ABA000-memory.dmp

Filesize
3.3MB

Download
memory/1604-134-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3024-140-0x0000000008980000-0x0000000008AAF000-memory.dmp

Filesize
1.2MB

Download
memory/3024-147-0x0000000008B80000-0x0000000008C39000-memory.dmp

Filesize
740KB

Download
memory/3024-152-0x0000000008D30000-0x0000000008DF6000-memory.dmp

Filesize
792KB

Download
memory/4380-141-0x0000022463020000-0x0000022463030000-memory.dmp

Filesize
64KB

Download
memory/4380-142-0x0000022463240000-0x0000022463250000-memory.dmp

Filesize
64KB

Download
memory/4380-143-0x0000022465730000-0x0000022465734000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads