xloader | d647a2e8ff08785b542bd885e62aed69fd43ea2dd801f5144bd990ec8719f3ed

General

Target
PURCHASE ORDER_PDF___________________________________.exe
Size 528KB
Sample220214-dda8jadhd9
SHA256 d647a2e8ff08785b542bd885e62aed69fd43ea2dd801f5144bd990ec8719f3ed
MD5 abf183eb397213a2f781fdde0a7740fe
SHA1 8c096b969627ae93588daeab1b27e29be56b566d
SHA512 8dd21b61e01ab225297932ebac52c93e2b5f0e39686df6aae872e17e74245fb71eb667879dd2305fdcda012e68758799b2105099cb671bc8e94632a269c21ecd
MD5 SHA1 SHA512

Score

10^/10

xloader ihg0 loader persistence rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ihg0

Decoy

mdmonoclonals.com
bologna-wine.com
threensales.com
slottomb.com
precisionmedicalbillings.com
sailorswife.online
agentguidebook.com
varharmvin.report
0eh.biz
osotactical.com
hpdsde.com
waryavier.online
raniisa.com
dreamemarat.com
superiorazmade.com
kinetoscopia.net
koomall66.com
klayraccoonman.com
pascal-rocha.com
initialepharma.com
ankaraogrenciescort.xyz
preparewithmontanahaven.com
mrq.claims
sicktreasuregame.icu
brightlightservices.net
atsym.com
natixis-us.com
fastpostvideo.com
maxcaffe.club
thehalpernschool.com
seassou.com
shanyanmoto.com
jgkjtp.xyz
beproudsmokeoutloud.com
zhendongshaicn.com
mainelygrownplantco.com
antonioac7.com
sprinklebabybowtique.com
mgav63.xyz
naveahboutique.com
sexboll.com
electcarolynvaughn.com
aqwastest.xyz
epindeyiz.com
monroetruckingco.com
outerverse.tech
bellissimord.com
staginglist.com
supra413.com
wordlunch.com
bigsyncmusic.info
quotexaustralia.com
geloradomino.win
yh88ff.com
lipe-engineering.com
nropes.com
james-betts.com
adrianvalarcon.com
avsvending.com
sicountrylive.com
olivehc.com
cryptopats.com
so-mobius.com
swedls.com
doquro.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/848-63-0x0000000000400000-0x000000000044B000-memory.dmp	xloader
behavioral1/memory/848-66-0x0000000000400000-0x000000000044B000-memory.dmp	xloader
behavioral1/memory/848-69-0x0000000001EB0000-0x0000000001ED9000-memory.dmp	xloader

Executes dropped EXE 2 IoCs

pid	Process
1516	dngqn.exe
848	dngqn.exe

Loads dropped DLL 5 IoCs

pid	Process
1608	PURCHASE ORDER_PDF___________________________________.exe
1516	dngqn.exe
1484	WerFault.exe
1484	WerFault.exe
1484	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\nacgxjfdhv = "C:\\Users\\Admin\\AppData\\Roaming\\dsanb\\paxascjluq.exe"	dngqn.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1516 set thread context of 848	1516	dngqn.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1484	848	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1484	WerFault.exe
1484	WerFault.exe
1484	WerFault.exe
1484	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1484	WerFault.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 1516	1608	PURCHASE ORDER_PDF___________________________________.exe	27
PID 1608 wrote to memory of 1516	1608	PURCHASE ORDER_PDF___________________________________.exe	27
PID 1608 wrote to memory of 1516	1608	PURCHASE ORDER_PDF___________________________________.exe	27
PID 1608 wrote to memory of 1516	1608	PURCHASE ORDER_PDF___________________________________.exe	27
PID 1516 wrote to memory of 848	1516	dngqn.exe	28
PID 1516 wrote to memory of 848	1516	dngqn.exe	28
PID 1516 wrote to memory of 848	1516	dngqn.exe	28
PID 1516 wrote to memory of 848	1516	dngqn.exe	28
PID 1516 wrote to memory of 848	1516	dngqn.exe	28
PID 1516 wrote to memory of 848	1516	dngqn.exe	28
PID 1516 wrote to memory of 848	1516	dngqn.exe	28
PID 1516 wrote to memory of 848	1516	dngqn.exe	28
PID 1516 wrote to memory of 848	1516	dngqn.exe	28
PID 1516 wrote to memory of 848	1516	dngqn.exe	28
PID 1516 wrote to memory of 848	1516	dngqn.exe	28
PID 848 wrote to memory of 1484	848	dngqn.exe	29
PID 848 wrote to memory of 1484	848	dngqn.exe	29
PID 848 wrote to memory of 1484	848	dngqn.exe	29
PID 848 wrote to memory of 1484	848	dngqn.exe	29

C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER_PDF___________________________________.exe
"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER_PDF___________________________________.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Users\Admin\AppData\Local\Temp\dngqn.exe
  C:\Users\Admin\AppData\Local\Temp\dngqn.exe C:\Users\Admin\AppData\Local\Temp\vqmnlu
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Users\Admin\AppData\Local\Temp\dngqn.exe
    C:\Users\Admin\AppData\Local\Temp\dngqn.exe C:\Users\Admin\AppData\Local\Temp\vqmnlu
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:848
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 524
      4⤵
      Loads dropped DLL
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-63-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/848-68-0x0000000004581000-0x0000000004582000-memory.dmp

Download

memory/848-69-0x0000000001EB0000-0x0000000001ED9000-memory.dmp

Download

memory/848-67-0x0000000073B1E000-0x0000000073B1F000-memory.dmp

Download

memory/848-66-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1484-74-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download

memory/1608-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads