xloader | c0a5470477f1ef65286a66e14b46c02b71c41eabc473b9885fbe7911844d90b7

General

Target

Purchase Order FEB22_76543.exe
Size

600KB
MD5

939ab865c8b7be3fdfaf765139a62f02
SHA1

fbe936019b2596e65ff25cb46abdb0f48fa93464
SHA256

c0a5470477f1ef65286a66e14b46c02b71c41eabc473b9885fbe7911844d90b7
SHA512

cf170932a7a1f57ea6e8e708bb28ec5c2487a40215b777a9cf6f653ebf3d75f32e95d00991de25d013fc3c7faa8ce5b13fbdbaeb12b8e752d808107e7695f763

Score

10^/10

xloader zqzw loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

zqzw

Decoy

laurentmathieu.com

nohohonndana.com

hhmc.info

shophallows.com

blazebunk.com

goodbridge.xyz

flakycloud.com

bakermckenziegroups.com

formation-adistance.com

lovingearthbotanicals.com

tbrservice.plus

heritagehousehotels.com

drwbuildersco.com

lacsghb.com

wain3x.com

dadreview.club

continiutycp.com

cockgirls.com

48mpt.xyz

033skz.xyz

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1368-63-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1392-70-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

676 cmd.exe

pid	process
676	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Purchase Order FEB22_76543.exePurchase Order FEB22_76543.execmmon32.exe

description	pid	process	target process
PID 1464 set thread context of 1368	1464	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 1368 set thread context of 1416	1368	Purchase Order FEB22_76543.exe	Explorer.EXE
PID 1392 set thread context of 1416	1392	cmmon32.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

Purchase Order FEB22_76543.exePurchase Order FEB22_76543.execmmon32.exe

pid	process
1464	Purchase Order FEB22_76543.exe
1464	Purchase Order FEB22_76543.exe
1368	Purchase Order FEB22_76543.exe
1368	Purchase Order FEB22_76543.exe
1392	cmmon32.exe
1392	cmmon32.exe
1392	cmmon32.exe
1392	cmmon32.exe
1392	cmmon32.exe
1392	cmmon32.exe
1392	cmmon32.exe
1392	cmmon32.exe
1392	cmmon32.exe
1392	cmmon32.exe
1392	cmmon32.exe
1392	cmmon32.exe
1392	cmmon32.exe
1392	cmmon32.exe
1392	cmmon32.exe
1392	cmmon32.exe
1392	cmmon32.exe
1392	cmmon32.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Purchase Order FEB22_76543.execmmon32.exe

pid process

1368 Purchase Order FEB22_76543.exe
1368 Purchase Order FEB22_76543.exe
1368 Purchase Order FEB22_76543.exe
1392 cmmon32.exe
1392 cmmon32.exe

pid	process
1368	Purchase Order FEB22_76543.exe
1368	Purchase Order FEB22_76543.exe
1368	Purchase Order FEB22_76543.exe
1392	cmmon32.exe
1392	cmmon32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Purchase Order FEB22_76543.exePurchase Order FEB22_76543.execmmon32.exe

description	pid	process
Token: SeDebugPrivilege	1464	Purchase Order FEB22_76543.exe
Token: SeDebugPrivilege	1368	Purchase Order FEB22_76543.exe
Token: SeDebugPrivilege	1392	cmmon32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1416 Explorer.EXE
1416 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1416 Explorer.EXE
1416 Explorer.EXE

pid	process
1416	Explorer.EXE
1416	Explorer.EXE

pid	process
1416	Explorer.EXE
1416	Explorer.EXE

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

Purchase Order FEB22_76543.exeExplorer.EXEcmmon32.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1416

C:\Users\Admin\AppData\Local\Temp\Purchase Order FEB22_76543.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Order FEB22_76543.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464

C:\Users\Admin\AppData\Local\Temp\Purchase Order FEB22_76543.exe
"{path}"
3⤵
PID:556

C:\Users\Admin\AppData\Local\Temp\Purchase Order FEB22_76543.exe
"{path}"
3⤵
PID:1212

C:\Users\Admin\AppData\Local\Temp\Purchase Order FEB22_76543.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:788

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1988

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1744

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:1152

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order FEB22_76543.exe"
3⤵
- Deletes itself
PID:676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-65-0x0000000000990000-0x0000000000C93000-memory.dmp

Filesize
3.0MB

Download
memory/1368-67-0x0000000000260000-0x0000000000271000-memory.dmp

Filesize
68KB

Download
memory/1368-61-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1368-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1368-63-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1368-66-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/1392-72-0x0000000001C60000-0x0000000001CF0000-memory.dmp

Filesize
576KB

Download
memory/1392-70-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/1392-71-0x0000000001EA0000-0x00000000021A3000-memory.dmp

Filesize
3.0MB

Download
memory/1392-69-0x00000000004A0000-0x00000000004AD000-memory.dmp

Filesize
52KB

Download
memory/1416-68-0x0000000006720000-0x00000000067D4000-memory.dmp

Filesize
720KB

Download
memory/1416-73-0x0000000006F20000-0x000000000708C000-memory.dmp

Filesize
1.4MB

Download
memory/1464-60-0x0000000001E70000-0x0000000001EA0000-memory.dmp

Filesize
192KB

Download
memory/1464-55-0x000000007469E000-0x000000007469F000-memory.dmp

Filesize
4KB

Download
memory/1464-59-0x0000000005660000-0x00000000056E2000-memory.dmp

Filesize
520KB

Download
memory/1464-58-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/1464-57-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1464-56-0x00000000001C0000-0x000000000025C000-memory.dmp

Filesize
624KB

Download

description	pid	process	target process
PID 1464 wrote to memory of 556	1464	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 1464 wrote to memory of 556	1464	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 1464 wrote to memory of 556	1464	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 1464 wrote to memory of 556	1464	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 1464 wrote to memory of 1212	1464	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 1464 wrote to memory of 1212	1464	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 1464 wrote to memory of 1212	1464	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 1464 wrote to memory of 1212	1464	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 1464 wrote to memory of 1368	1464	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 1464 wrote to memory of 1368	1464	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 1464 wrote to memory of 1368	1464	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 1464 wrote to memory of 1368	1464	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 1464 wrote to memory of 1368	1464	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 1464 wrote to memory of 1368	1464	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 1464 wrote to memory of 1368	1464	Purchase Order FEB22_76543.exe	Purchase Order FEB22_76543.exe
PID 1416 wrote to memory of 1392	1416	Explorer.EXE	cmmon32.exe
PID 1416 wrote to memory of 1392	1416	Explorer.EXE	cmmon32.exe
PID 1416 wrote to memory of 1392	1416	Explorer.EXE	cmmon32.exe
PID 1416 wrote to memory of 1392	1416	Explorer.EXE	cmmon32.exe
PID 1392 wrote to memory of 676	1392	cmmon32.exe	cmd.exe
PID 1392 wrote to memory of 676	1392	cmmon32.exe	cmd.exe
PID 1392 wrote to memory of 676	1392	cmmon32.exe	cmd.exe
PID 1392 wrote to memory of 676	1392	cmmon32.exe	cmd.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads