xloader | dfe742ea984310b86ce1d553b87e63f4cdefcf8485b7c860438234377a10a358

General

Target

DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
Size

30KB
MD5

c2ed847cba51543076504a7150261f22
SHA1

93e063e8f777b42cab7f7ed8fa45a2397942dead
SHA256

dfe742ea984310b86ce1d553b87e63f4cdefcf8485b7c860438234377a10a358
SHA512

4dca34f7a0c0ecf2018de5a0e2ba5a9145cfdac508dafa1f5de5fad4072703f6621587b164a742d094cb557e8cedba5630cd7477fbf355a6311ac457c0cb5670

Score

10^/10

xloader po6r loader persistence rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

po6r

Decoy

jnhuichuangxin.com

mubashir.art

extol.design

doyyindh.xyz

milanoautoexperts.com

4thefringe.com

453511.com

sellathonautocredit.com

velgian.com

6672pk.com

wodeluzhou.com

sumiyoshiku-hizaita.xyz

imoveldeprimeira.com

dgjssp.com

endokc.com

side-clicks.com

cashndashfinancial.com

vanhemelryck.info

agamitrading.com

woofgang.xyz

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\kellybrown.exe\","	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/788-63-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/788-65-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1672-73-0x0000000000090000-0x00000000000B9000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

Processes:

DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exeDHL - OVERDUE ACCOUNT NOTICE - 1301474408.exemsiexec.exe

description	pid	process	target process
PID 1180 set thread context of 788	1180	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 788 set thread context of 1448	788	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	Explorer.EXE
PID 1672 set thread context of 1448	1672	msiexec.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exeDHL - OVERDUE ACCOUNT NOTICE - 1301474408.exemsiexec.exe

pid	process
1180	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
1180	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
788	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
788	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
1672	msiexec.exe
1672	msiexec.exe
1672	msiexec.exe
1672	msiexec.exe
1672	msiexec.exe
1672	msiexec.exe
1672	msiexec.exe
1672	msiexec.exe
1672	msiexec.exe
1672	msiexec.exe
1672	msiexec.exe
1672	msiexec.exe
1672	msiexec.exe
1672	msiexec.exe
1672	msiexec.exe
1672	msiexec.exe
1672	msiexec.exe
1672	msiexec.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exemsiexec.exe

pid	process
788	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
788	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
788	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
1672	msiexec.exe
1672	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exeDHL - OVERDUE ACCOUNT NOTICE - 1301474408.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1180	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
Token: SeDebugPrivilege	788	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
Token: SeDebugPrivilege	1672	msiexec.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exeExplorer.EXE

description	pid	process	target process
PID 1180 wrote to memory of 788	1180	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 1180 wrote to memory of 788	1180	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 1180 wrote to memory of 788	1180	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 1180 wrote to memory of 788	1180	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 1180 wrote to memory of 788	1180	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 1180 wrote to memory of 788	1180	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 1180 wrote to memory of 788	1180	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 1448 wrote to memory of 1672	1448	Explorer.EXE	msiexec.exe
PID 1448 wrote to memory of 1672	1448	Explorer.EXE	msiexec.exe
PID 1448 wrote to memory of 1672	1448	Explorer.EXE	msiexec.exe
PID 1448 wrote to memory of 1672	1448	Explorer.EXE	msiexec.exe
PID 1448 wrote to memory of 1672	1448	Explorer.EXE	msiexec.exe
PID 1448 wrote to memory of 1672	1448	Explorer.EXE	msiexec.exe
PID 1448 wrote to memory of 1672	1448	Explorer.EXE	msiexec.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Users\Admin\AppData\Local\Temp\DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
    "C:\Users\Admin\AppData\Local\Temp\DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:788
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-68-0x00000000002D0000-0x00000000002E1000-memory.dmp

Filesize
68KB

Download
memory/788-65-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/788-63-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/788-61-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/788-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/788-66-0x0000000000A00000-0x0000000000D03000-memory.dmp

Filesize
3.0MB

Download
memory/788-67-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/1180-58-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1180-59-0x0000000005FC0000-0x0000000006076000-memory.dmp

Filesize
728KB

Download
memory/1180-60-0x00000000048F0000-0x000000000493C000-memory.dmp

Filesize
304KB

Download
memory/1180-57-0x00000000049E0000-0x00000000049E1000-memory.dmp

Filesize
4KB

Download
memory/1180-56-0x0000000001060000-0x000000000106E000-memory.dmp

Filesize
56KB

Download
memory/1180-55-0x000000007445E000-0x000000007445F000-memory.dmp

Filesize
4KB

Download
memory/1448-75-0x0000000005000000-0x00000000050AA000-memory.dmp

Filesize
680KB

Download
memory/1448-69-0x0000000006730000-0x0000000006864000-memory.dmp

Filesize
1.2MB

Download
memory/1672-71-0x0000000000900000-0x0000000000914000-memory.dmp

Filesize
80KB

Download
memory/1672-72-0x00000000020F0000-0x00000000023F3000-memory.dmp

Filesize
3.0MB

Download
memory/1672-73-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/1672-74-0x0000000001E20000-0x0000000001EB0000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads