xloader | 6370ffa17cea91839f8a40555da2ef41f0e97d539e4bdc60871a7783abcdd7f6

General

Target

8c6d84464096e6d1849c689708516a8d.exe
Size

385KB
MD5

8c6d84464096e6d1849c689708516a8d
SHA1

8be47c3512da862eacddc5f4e1eddc55d0e8d4bb
SHA256

6370ffa17cea91839f8a40555da2ef41f0e97d539e4bdc60871a7783abcdd7f6
SHA512

02913ecf4ab9927c86efb3add83a9edf21de2269acc49b698296626242d5aa04cd89eb8ac267ddafac82d39a2fa099e7474cd70f13f22ab324d1c54f14fbe967

Score

10^/10

xloader ahc8 loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/456-62-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/456-65-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1900-76-0x0000000000120000-0x0000000000149000-memory.dmp	xloader

Executes dropped EXE 2 IoCs

Processes:

mgavd.exemgavd.exe

pid process

2044 mgavd.exe
456 mgavd.exe
Loads dropped DLL 2 IoCs

Processes:

8c6d84464096e6d1849c689708516a8d.exemgavd.exe

pid process

1660 8c6d84464096e6d1849c689708516a8d.exe
2044 mgavd.exe

pid	process
2044	mgavd.exe
456	mgavd.exe

pid	process
1660	8c6d84464096e6d1849c689708516a8d.exe
2044	mgavd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

mgavd.exemgavd.exeraserver.exe

description	pid	process	target process
PID 2044 set thread context of 456	2044	mgavd.exe	mgavd.exe
PID 456 set thread context of 1228	456	mgavd.exe	Explorer.EXE
PID 456 set thread context of 1228	456	mgavd.exe	Explorer.EXE
PID 1900 set thread context of 1228	1900	raserver.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

mgavd.exeraserver.exe

pid	process
456	mgavd.exe
456	mgavd.exe
456	mgavd.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe
1900	raserver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1228 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

mgavd.exeraserver.exe

pid process

456 mgavd.exe
456 mgavd.exe
456 mgavd.exe
456 mgavd.exe
1900 raserver.exe
1900 raserver.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

mgavd.exeraserver.exe

description pid process

Token: SeDebugPrivilege 456 mgavd.exe
Token: SeDebugPrivilege 1900 raserver.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1228 Explorer.EXE
1228 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1228 Explorer.EXE
1228 Explorer.EXE

pid	process
1228	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	456	mgavd.exe
Token: SeDebugPrivilege	1900	raserver.exe

pid	process
1228	Explorer.EXE
1228	Explorer.EXE

pid	process
1228	Explorer.EXE
1228	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

8c6d84464096e6d1849c689708516a8d.exemgavd.exeExplorer.EXEraserver.exe

description	pid	process	target process
PID 1660 wrote to memory of 2044	1660	8c6d84464096e6d1849c689708516a8d.exe	mgavd.exe
PID 1660 wrote to memory of 2044	1660	8c6d84464096e6d1849c689708516a8d.exe	mgavd.exe
PID 1660 wrote to memory of 2044	1660	8c6d84464096e6d1849c689708516a8d.exe	mgavd.exe
PID 1660 wrote to memory of 2044	1660	8c6d84464096e6d1849c689708516a8d.exe	mgavd.exe
PID 2044 wrote to memory of 456	2044	mgavd.exe	mgavd.exe
PID 2044 wrote to memory of 456	2044	mgavd.exe	mgavd.exe
PID 2044 wrote to memory of 456	2044	mgavd.exe	mgavd.exe
PID 2044 wrote to memory of 456	2044	mgavd.exe	mgavd.exe
PID 2044 wrote to memory of 456	2044	mgavd.exe	mgavd.exe
PID 2044 wrote to memory of 456	2044	mgavd.exe	mgavd.exe
PID 2044 wrote to memory of 456	2044	mgavd.exe	mgavd.exe
PID 1228 wrote to memory of 1900	1228	Explorer.EXE	raserver.exe
PID 1228 wrote to memory of 1900	1228	Explorer.EXE	raserver.exe
PID 1228 wrote to memory of 1900	1228	Explorer.EXE	raserver.exe
PID 1228 wrote to memory of 1900	1228	Explorer.EXE	raserver.exe
PID 1900 wrote to memory of 1104	1900	raserver.exe	cmd.exe
PID 1900 wrote to memory of 1104	1900	raserver.exe	cmd.exe
PID 1900 wrote to memory of 1104	1900	raserver.exe	cmd.exe
PID 1900 wrote to memory of 1104	1900	raserver.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228

C:\Users\Admin\AppData\Local\Temp\8c6d84464096e6d1849c689708516a8d.exe
"C:\Users\Admin\AppData\Local\Temp\8c6d84464096e6d1849c689708516a8d.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1660

C:\Users\Admin\AppData\Local\Temp\mgavd.exe
C:\Users\Admin\AppData\Local\Temp\mgavd.exe C:\Users\Admin\AppData\Local\Temp\qkiged
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\Temp\mgavd.exe
C:\Users\Admin\AppData\Local\Temp\mgavd.exe C:\Users\Admin\AppData\Local\Temp\qkiged
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:456

C:\Windows\SysWOW64\raserver.exe
"C:\Windows\SysWOW64\raserver.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\mgavd.exe"
3⤵
PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cnqpil5ibr72wg
MD5
63539c239244dbf6f83e1cc1ebb0a444

SHA1
67247ee80ed7f59271e7d897a683ce503cde51c3

SHA256
1bbd6f3f30511de3bf7c7643d929edd1f863c0f0bd67331d99b58cb170f61993

SHA512
5049f48fe77653a511e5949cfe6c565611f68ae08a557385fb70833495455021fe2ec657c9e127e0e3169dd2127dc136df73b4c361d3bd71661d6f51b28c5d11

Download Submit
C:\Users\Admin\AppData\Local\Temp\mgavd.exe
MD5
1738f16649edcdc550f3e20daa46eafc

SHA1
5368d6a6a275a46f5db8bc32a918555321d64a63

SHA256
668cc6abe5a037b7570fe87a8f1f8aa0e31da4479e7f9ebf188462176d889a35

SHA512
d0b348417cb75064e2553b17b0252d05f18bd76491a2c4a90202f21f875b50d3f097933e67c1cb67e6e2be320ca6080ba9120a118677a2df563f0e3dbfe61b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\mgavd.exe
MD5
1738f16649edcdc550f3e20daa46eafc

SHA1
5368d6a6a275a46f5db8bc32a918555321d64a63

SHA256
668cc6abe5a037b7570fe87a8f1f8aa0e31da4479e7f9ebf188462176d889a35

SHA512
d0b348417cb75064e2553b17b0252d05f18bd76491a2c4a90202f21f875b50d3f097933e67c1cb67e6e2be320ca6080ba9120a118677a2df563f0e3dbfe61b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\mgavd.exe
MD5
1738f16649edcdc550f3e20daa46eafc

SHA1
5368d6a6a275a46f5db8bc32a918555321d64a63

SHA256
668cc6abe5a037b7570fe87a8f1f8aa0e31da4479e7f9ebf188462176d889a35

SHA512
d0b348417cb75064e2553b17b0252d05f18bd76491a2c4a90202f21f875b50d3f097933e67c1cb67e6e2be320ca6080ba9120a118677a2df563f0e3dbfe61b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\qkiged
MD5
9b99f44011ecc5da234e3f81f9623261

SHA1
1f0b6c9dcff5bc24595fc35d775713dc6f5cce7f

SHA256
7014625142806826e7427ec69626abe3d15ce7b21286881eb8c48bcb96d0c47c

SHA512
1af1e48b36ad4584d4340e09344dba060974469e5defe7bef9b31e93a6d61b95276c5139f4ae2f5c4342806d75a240753440aaa0805e31406b46617093ff2268

Download Submit
\Users\Admin\AppData\Local\Temp\mgavd.exe
MD5
1738f16649edcdc550f3e20daa46eafc

SHA1
5368d6a6a275a46f5db8bc32a918555321d64a63

SHA256
668cc6abe5a037b7570fe87a8f1f8aa0e31da4479e7f9ebf188462176d889a35

SHA512
d0b348417cb75064e2553b17b0252d05f18bd76491a2c4a90202f21f875b50d3f097933e67c1cb67e6e2be320ca6080ba9120a118677a2df563f0e3dbfe61b13

Download Submit
\Users\Admin\AppData\Local\Temp\mgavd.exe
MD5
1738f16649edcdc550f3e20daa46eafc

SHA1
5368d6a6a275a46f5db8bc32a918555321d64a63

SHA256
668cc6abe5a037b7570fe87a8f1f8aa0e31da4479e7f9ebf188462176d889a35

SHA512
d0b348417cb75064e2553b17b0252d05f18bd76491a2c4a90202f21f875b50d3f097933e67c1cb67e6e2be320ca6080ba9120a118677a2df563f0e3dbfe61b13

Download Submit
memory/456-66-0x0000000000890000-0x0000000000B93000-memory.dmp

Filesize
3.0MB

Download
memory/456-72-0x0000000000390000-0x00000000003A1000-memory.dmp

Filesize
68KB

Download
memory/456-65-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/456-71-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/456-68-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/456-67-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/456-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1228-69-0x0000000006AC0000-0x0000000006C28000-memory.dmp

Filesize
1.4MB

Download
memory/1228-73-0x0000000007310000-0x0000000007453000-memory.dmp

Filesize
1.3MB

Download
memory/1228-79-0x0000000004B80000-0x0000000004C3C000-memory.dmp

Filesize
752KB

Download
memory/1660-55-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1900-76-0x0000000000120000-0x0000000000149000-memory.dmp

Filesize
164KB

Download
memory/1900-75-0x0000000000800000-0x000000000081C000-memory.dmp

Filesize
112KB

Download
memory/1900-77-0x0000000001EF0000-0x00000000021F3000-memory.dmp

Filesize
3.0MB

Download
memory/1900-78-0x0000000001D20000-0x0000000001DB0000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads