xloader | 6370ffa17cea91839f8a40555da2ef41f0e97d539e4bdc60871a7783abcdd7f6

General

Target

win32.exe
Size

385KB
MD5

8c6d84464096e6d1849c689708516a8d
SHA1

8be47c3512da862eacddc5f4e1eddc55d0e8d4bb
SHA256

6370ffa17cea91839f8a40555da2ef41f0e97d539e4bdc60871a7783abcdd7f6
SHA512

02913ecf4ab9927c86efb3add83a9edf21de2269acc49b698296626242d5aa04cd89eb8ac267ddafac82d39a2fa099e7474cd70f13f22ab324d1c54f14fbe967

Score

10^/10

xloader ahc8 loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1124-61-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1124-68-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/360-73-0x00000000000D0000-0x00000000000F9000-memory.dmp	xloader

Executes dropped EXE 2 IoCs

Processes:

mgavd.exemgavd.exe

pid process

588 mgavd.exe
1124 mgavd.exe
Loads dropped DLL 2 IoCs

Processes:

win32.exemgavd.exe

pid process

1048 win32.exe
588 mgavd.exe

pid	process
588	mgavd.exe
1124	mgavd.exe

pid	process
1048	win32.exe
588	mgavd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

mgavd.exemgavd.exewininit.exe

description	pid	process	target process
PID 588 set thread context of 1124	588	mgavd.exe	mgavd.exe
PID 1124 set thread context of 1220	1124	mgavd.exe	Explorer.EXE
PID 1124 set thread context of 1220	1124	mgavd.exe	Explorer.EXE
PID 360 set thread context of 1220	360	wininit.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

mgavd.exewininit.exe

pid	process
1124	mgavd.exe
1124	mgavd.exe
1124	mgavd.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe
360	wininit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1220 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

mgavd.exewininit.exe

pid process

1124 mgavd.exe
1124 mgavd.exe
1124 mgavd.exe
1124 mgavd.exe
360 wininit.exe
360 wininit.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

mgavd.exewininit.exe

description pid process

Token: SeDebugPrivilege 1124 mgavd.exe
Token: SeDebugPrivilege 360 wininit.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1220 Explorer.EXE
1220 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1220 Explorer.EXE
1220 Explorer.EXE

pid	process
1220	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1124	mgavd.exe
Token: SeDebugPrivilege	360	wininit.exe

pid	process
1220	Explorer.EXE
1220	Explorer.EXE

pid	process
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

win32.exemgavd.exeExplorer.EXEwininit.exe

description	pid	process	target process
PID 1048 wrote to memory of 588	1048	win32.exe	mgavd.exe
PID 1048 wrote to memory of 588	1048	win32.exe	mgavd.exe
PID 1048 wrote to memory of 588	1048	win32.exe	mgavd.exe
PID 1048 wrote to memory of 588	1048	win32.exe	mgavd.exe
PID 588 wrote to memory of 1124	588	mgavd.exe	mgavd.exe
PID 588 wrote to memory of 1124	588	mgavd.exe	mgavd.exe
PID 588 wrote to memory of 1124	588	mgavd.exe	mgavd.exe
PID 588 wrote to memory of 1124	588	mgavd.exe	mgavd.exe
PID 588 wrote to memory of 1124	588	mgavd.exe	mgavd.exe
PID 588 wrote to memory of 1124	588	mgavd.exe	mgavd.exe
PID 588 wrote to memory of 1124	588	mgavd.exe	mgavd.exe
PID 1220 wrote to memory of 360	1220	Explorer.EXE	wininit.exe
PID 1220 wrote to memory of 360	1220	Explorer.EXE	wininit.exe
PID 1220 wrote to memory of 360	1220	Explorer.EXE	wininit.exe
PID 1220 wrote to memory of 360	1220	Explorer.EXE	wininit.exe
PID 360 wrote to memory of 1788	360	wininit.exe	cmd.exe
PID 360 wrote to memory of 1788	360	wininit.exe	cmd.exe
PID 360 wrote to memory of 1788	360	wininit.exe	cmd.exe
PID 360 wrote to memory of 1788	360	wininit.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1220

C:\Users\Admin\AppData\Local\Temp\win32.exe
"C:\Users\Admin\AppData\Local\Temp\win32.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1048

C:\Users\Admin\AppData\Local\Temp\mgavd.exe
C:\Users\Admin\AppData\Local\Temp\mgavd.exe C:\Users\Admin\AppData\Local\Temp\qkiged
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:588

C:\Users\Admin\AppData\Local\Temp\mgavd.exe
C:\Users\Admin\AppData\Local\Temp\mgavd.exe C:\Users\Admin\AppData\Local\Temp\qkiged
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Windows\SysWOW64\wininit.exe
"C:\Windows\SysWOW64\wininit.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:360

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\mgavd.exe"
3⤵
PID:1788

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cnqpil5ibr72wg
MD5
63539c239244dbf6f83e1cc1ebb0a444

SHA1
67247ee80ed7f59271e7d897a683ce503cde51c3

SHA256
1bbd6f3f30511de3bf7c7643d929edd1f863c0f0bd67331d99b58cb170f61993

SHA512
5049f48fe77653a511e5949cfe6c565611f68ae08a557385fb70833495455021fe2ec657c9e127e0e3169dd2127dc136df73b4c361d3bd71661d6f51b28c5d11

Download Submit
C:\Users\Admin\AppData\Local\Temp\mgavd.exe
MD5
1738f16649edcdc550f3e20daa46eafc

SHA1
5368d6a6a275a46f5db8bc32a918555321d64a63

SHA256
668cc6abe5a037b7570fe87a8f1f8aa0e31da4479e7f9ebf188462176d889a35

SHA512
d0b348417cb75064e2553b17b0252d05f18bd76491a2c4a90202f21f875b50d3f097933e67c1cb67e6e2be320ca6080ba9120a118677a2df563f0e3dbfe61b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\mgavd.exe
MD5
1738f16649edcdc550f3e20daa46eafc

SHA1
5368d6a6a275a46f5db8bc32a918555321d64a63

SHA256
668cc6abe5a037b7570fe87a8f1f8aa0e31da4479e7f9ebf188462176d889a35

SHA512
d0b348417cb75064e2553b17b0252d05f18bd76491a2c4a90202f21f875b50d3f097933e67c1cb67e6e2be320ca6080ba9120a118677a2df563f0e3dbfe61b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\mgavd.exe
MD5
1738f16649edcdc550f3e20daa46eafc

SHA1
5368d6a6a275a46f5db8bc32a918555321d64a63

SHA256
668cc6abe5a037b7570fe87a8f1f8aa0e31da4479e7f9ebf188462176d889a35

SHA512
d0b348417cb75064e2553b17b0252d05f18bd76491a2c4a90202f21f875b50d3f097933e67c1cb67e6e2be320ca6080ba9120a118677a2df563f0e3dbfe61b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\qkiged
MD5
9b99f44011ecc5da234e3f81f9623261

SHA1
1f0b6c9dcff5bc24595fc35d775713dc6f5cce7f

SHA256
7014625142806826e7427ec69626abe3d15ce7b21286881eb8c48bcb96d0c47c

SHA512
1af1e48b36ad4584d4340e09344dba060974469e5defe7bef9b31e93a6d61b95276c5139f4ae2f5c4342806d75a240753440aaa0805e31406b46617093ff2268

Download Submit
\Users\Admin\AppData\Local\Temp\mgavd.exe
MD5
1738f16649edcdc550f3e20daa46eafc

SHA1
5368d6a6a275a46f5db8bc32a918555321d64a63

SHA256
668cc6abe5a037b7570fe87a8f1f8aa0e31da4479e7f9ebf188462176d889a35

SHA512
d0b348417cb75064e2553b17b0252d05f18bd76491a2c4a90202f21f875b50d3f097933e67c1cb67e6e2be320ca6080ba9120a118677a2df563f0e3dbfe61b13

Download Submit
\Users\Admin\AppData\Local\Temp\mgavd.exe
MD5
1738f16649edcdc550f3e20daa46eafc

SHA1
5368d6a6a275a46f5db8bc32a918555321d64a63

SHA256
668cc6abe5a037b7570fe87a8f1f8aa0e31da4479e7f9ebf188462176d889a35

SHA512
d0b348417cb75064e2553b17b0252d05f18bd76491a2c4a90202f21f875b50d3f097933e67c1cb67e6e2be320ca6080ba9120a118677a2df563f0e3dbfe61b13

Download Submit
memory/360-72-0x0000000000B10000-0x0000000000B2A000-memory.dmp

Filesize
104KB

Download
memory/360-75-0x0000000000960000-0x00000000009F0000-memory.dmp

Filesize
576KB

Download
memory/360-74-0x00000000020C0000-0x00000000023C3000-memory.dmp

Filesize
3.0MB

Download
memory/360-73-0x00000000000D0000-0x00000000000F9000-memory.dmp

Filesize
164KB

Download
memory/1048-54-0x00000000754B1000-0x00000000754B3000-memory.dmp

Filesize
8KB

Download
memory/1124-65-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/1124-68-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1124-69-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/1124-70-0x0000000000310000-0x0000000000321000-memory.dmp

Filesize
68KB

Download
memory/1124-66-0x00000000002C0000-0x00000000002D1000-memory.dmp

Filesize
68KB

Download
memory/1124-64-0x0000000000860000-0x0000000000B63000-memory.dmp

Filesize
3.0MB

Download
memory/1124-61-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1220-71-0x00000000075A0000-0x00000000076CC000-memory.dmp

Filesize
1.2MB

Download
memory/1220-67-0x0000000004C40000-0x0000000004D08000-memory.dmp

Filesize
800KB

Download
memory/1220-76-0x0000000004360000-0x00000000043FD000-memory.dmp

Filesize
628KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads