xloader | cd4ee025ad3406b7e572952d42465eee19649cef6c0d3a6acbb0e972096988f4

General

Target

DELIVERY DOCUMENTS.exe
Size

707KB
MD5

427ef5f4e1143ad34c33b26dc4681661
SHA1

673fb1a58e4707ad783d03ca97b3fbd8b4cad73a
SHA256

cd4ee025ad3406b7e572952d42465eee19649cef6c0d3a6acbb0e972096988f4
SHA512

b225afbb07853516f1b741e833e1a63026c0dc5adbb0c3fcfb48f8c6681bc770558499df3d3f5c17df45395dedc3624a1e8fa6498395ac20a82f44e27a61dfbb

Score

10^/10

xloader zqzw loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

zqzw

Decoy

laurentmathieu.com

nohohonndana.com

hhmc.info

shophallows.com

blazebunk.com

goodbridge.xyz

flakycloud.com

bakermckenziegroups.com

formation-adistance.com

lovingearthbotanicals.com

tbrservice.plus

heritagehousehotels.com

drwbuildersco.com

lacsghb.com

wain3x.com

dadreview.club

continiutycp.com

cockgirls.com

48mpt.xyz

033skz.xyz

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1428-138-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/992-145-0x0000000001080000-0x00000000010A9000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

Processes:

DELIVERY DOCUMENTS.exeDELIVERY DOCUMENTS.exesvchost.exe

description	pid	process	target process
PID 1588 set thread context of 1428	1588	DELIVERY DOCUMENTS.exe	DELIVERY DOCUMENTS.exe
PID 1428 set thread context of 2436	1428	DELIVERY DOCUMENTS.exe	Explorer.EXE
PID 992 set thread context of 2436	992	svchost.exe	Explorer.EXE

Drops file in Windows directory 8 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

DELIVERY DOCUMENTS.exesvchost.exe

pid	process
1428	DELIVERY DOCUMENTS.exe
1428	DELIVERY DOCUMENTS.exe
1428	DELIVERY DOCUMENTS.exe
1428	DELIVERY DOCUMENTS.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe
992	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2436 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

DELIVERY DOCUMENTS.exesvchost.exe

pid process

1428 DELIVERY DOCUMENTS.exe
1428 DELIVERY DOCUMENTS.exe
1428 DELIVERY DOCUMENTS.exe
992 svchost.exe
992 svchost.exe

pid	process
2436	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exeTiWorker.exe

description	pid	process
Token: SeShutdownPrivilege	2108	svchost.exe
Token: SeCreatePagefilePrivilege	2108	svchost.exe
Token: SeShutdownPrivilege	2108	svchost.exe
Token: SeCreatePagefilePrivilege	2108	svchost.exe
Token: SeShutdownPrivilege	2108	svchost.exe
Token: SeCreatePagefilePrivilege	2108	svchost.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe
Token: SeRestorePrivilege	3804	TiWorker.exe
Token: SeSecurityPrivilege	3804	TiWorker.exe
Token: SeBackupPrivilege	3804	TiWorker.exe

Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

2436 Explorer.EXE

pid	process
2436	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

DELIVERY DOCUMENTS.exeExplorer.EXEsvchost.exe

description	pid	process	target process
PID 1588 wrote to memory of 1428	1588	DELIVERY DOCUMENTS.exe	DELIVERY DOCUMENTS.exe
PID 1588 wrote to memory of 1428	1588	DELIVERY DOCUMENTS.exe	DELIVERY DOCUMENTS.exe
PID 1588 wrote to memory of 1428	1588	DELIVERY DOCUMENTS.exe	DELIVERY DOCUMENTS.exe
PID 1588 wrote to memory of 1428	1588	DELIVERY DOCUMENTS.exe	DELIVERY DOCUMENTS.exe
PID 1588 wrote to memory of 1428	1588	DELIVERY DOCUMENTS.exe	DELIVERY DOCUMENTS.exe
PID 1588 wrote to memory of 1428	1588	DELIVERY DOCUMENTS.exe	DELIVERY DOCUMENTS.exe
PID 2436 wrote to memory of 992	2436	Explorer.EXE	svchost.exe
PID 2436 wrote to memory of 992	2436	Explorer.EXE	svchost.exe
PID 2436 wrote to memory of 992	2436	Explorer.EXE	svchost.exe
PID 992 wrote to memory of 2332	992	svchost.exe	cmd.exe
PID 992 wrote to memory of 2332	992	svchost.exe	cmd.exe
PID 992 wrote to memory of 2332	992	svchost.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2436

C:\Users\Admin\AppData\Local\Temp\DELIVERY DOCUMENTS.exe
"C:\Users\Admin\AppData\Local\Temp\DELIVERY DOCUMENTS.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1588

C:\Users\Admin\AppData\Local\Temp\DELIVERY DOCUMENTS.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1428

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\DELIVERY DOCUMENTS.exe"
3⤵
PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-147-0x0000000001A00000-0x0000000001A90000-memory.dmp

Filesize
576KB

Download
memory/992-146-0x0000000001B00000-0x0000000001E4A000-memory.dmp

Filesize
3.3MB

Download
memory/992-145-0x0000000001080000-0x00000000010A9000-memory.dmp

Filesize
164KB

Download
memory/992-144-0x00000000006E0000-0x00000000006EE000-memory.dmp

Filesize
56KB

Download
memory/1428-138-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1428-142-0x0000000001840000-0x0000000001851000-memory.dmp

Filesize
68KB

Download
memory/1428-141-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/1428-139-0x0000000001970000-0x0000000001CBA000-memory.dmp

Filesize
3.3MB

Download
memory/1588-134-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/1588-130-0x0000000000470000-0x0000000000528000-memory.dmp

Filesize
736KB

Download
memory/1588-133-0x0000000005160000-0x00000000051F2000-memory.dmp

Filesize
584KB

Download
memory/1588-132-0x00000000050C0000-0x000000000515C000-memory.dmp

Filesize
624KB

Download
memory/1588-131-0x0000000074BDE000-0x0000000074BDF000-memory.dmp

Filesize
4KB

Download
memory/2108-137-0x000001E0D2590000-0x000001E0D2594000-memory.dmp

Filesize
16KB

Download
memory/2108-136-0x000001E0CFF20000-0x000001E0CFF30000-memory.dmp

Filesize
64KB

Download
memory/2108-135-0x000001E0CF960000-0x000001E0CF970000-memory.dmp

Filesize
64KB

Download
memory/2436-143-0x00000000087A0000-0x0000000008880000-memory.dmp

Filesize
896KB

Download
memory/2436-148-0x0000000008950000-0x0000000008AB5000-memory.dmp

Filesize
1.4MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads