xloader | 6370ffa17cea91839f8a40555da2ef41f0e97d539e4bdc60871a7783abcdd7f6

General

Target

win32.exe
Size

385KB
MD5

8c6d84464096e6d1849c689708516a8d
SHA1

8be47c3512da862eacddc5f4e1eddc55d0e8d4bb
SHA256

6370ffa17cea91839f8a40555da2ef41f0e97d539e4bdc60871a7783abcdd7f6
SHA512

02913ecf4ab9927c86efb3add83a9edf21de2269acc49b698296626242d5aa04cd89eb8ac267ddafac82d39a2fa099e7474cd70f13f22ab324d1c54f14fbe967

Score

10^/10

xloader ahc8 loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4048-134-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/1804-143-0x0000000000EF0000-0x0000000000F19000-memory.dmp	xloader

Executes dropped EXE 2 IoCs

Processes:

mgavd.exemgavd.exe

pid process

2916 mgavd.exe
4048 mgavd.exe

pid	process
2916	mgavd.exe
4048	mgavd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

mgavd.exemgavd.exehelp.exe

description	pid	process	target process
PID 2916 set thread context of 4048	2916	mgavd.exe	mgavd.exe
PID 4048 set thread context of 3020	4048	mgavd.exe	Explorer.EXE
PID 1804 set thread context of 3020	1804	help.exe	Explorer.EXE

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 54 IoCs

Processes:

mgavd.exehelp.exe

pid	process
4048	mgavd.exe
4048	mgavd.exe
4048	mgavd.exe
4048	mgavd.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe
1804	help.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3020 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

mgavd.exehelp.exe

pid process

4048 mgavd.exe
4048 mgavd.exe
4048 mgavd.exe
1804 help.exe
1804 help.exe

pid	process
3020	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

mgavd.exehelp.exesvchost.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	4048	mgavd.exe
Token: SeDebugPrivilege	1804	help.exe
Token: SeShutdownPrivilege	932	svchost.exe
Token: SeCreatePagefilePrivilege	932	svchost.exe
Token: SeShutdownPrivilege	932	svchost.exe
Token: SeCreatePagefilePrivilege	932	svchost.exe
Token: SeShutdownPrivilege	932	svchost.exe
Token: SeCreatePagefilePrivilege	932	svchost.exe
Token: SeShutdownPrivilege	3020	Explorer.EXE
Token: SeCreatePagefilePrivilege	3020	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

win32.exemgavd.exeExplorer.EXEhelp.exe

description	pid	process	target process
PID 1312 wrote to memory of 2916	1312	win32.exe	mgavd.exe
PID 1312 wrote to memory of 2916	1312	win32.exe	mgavd.exe
PID 1312 wrote to memory of 2916	1312	win32.exe	mgavd.exe
PID 2916 wrote to memory of 4048	2916	mgavd.exe	mgavd.exe
PID 2916 wrote to memory of 4048	2916	mgavd.exe	mgavd.exe
PID 2916 wrote to memory of 4048	2916	mgavd.exe	mgavd.exe
PID 2916 wrote to memory of 4048	2916	mgavd.exe	mgavd.exe
PID 2916 wrote to memory of 4048	2916	mgavd.exe	mgavd.exe
PID 2916 wrote to memory of 4048	2916	mgavd.exe	mgavd.exe
PID 3020 wrote to memory of 1804	3020	Explorer.EXE	help.exe
PID 3020 wrote to memory of 1804	3020	Explorer.EXE	help.exe
PID 3020 wrote to memory of 1804	3020	Explorer.EXE	help.exe
PID 1804 wrote to memory of 4028	1804	help.exe	cmd.exe
PID 1804 wrote to memory of 4028	1804	help.exe	cmd.exe
PID 1804 wrote to memory of 4028	1804	help.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\win32.exe
  "C:\Users\Admin\AppData\Local\Temp\win32.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Users\Admin\AppData\Local\Temp\mgavd.exe
    C:\Users\Admin\AppData\Local\Temp\mgavd.exe C:\Users\Admin\AppData\Local\Temp\qkiged
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\mgavd.exe
      C:\Users\Admin\AppData\Local\Temp\mgavd.exe C:\Users\Admin\AppData\Local\Temp\qkiged
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:4048
- C:\Windows\SysWOW64\help.exe
  "C:\Windows\SysWOW64\help.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\mgavd.exe"
    3⤵
    PID:4028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cnqpil5ibr72wg

MD5
63539c239244dbf6f83e1cc1ebb0a444

SHA1
67247ee80ed7f59271e7d897a683ce503cde51c3

SHA256
1bbd6f3f30511de3bf7c7643d929edd1f863c0f0bd67331d99b58cb170f61993

SHA512
5049f48fe77653a511e5949cfe6c565611f68ae08a557385fb70833495455021fe2ec657c9e127e0e3169dd2127dc136df73b4c361d3bd71661d6f51b28c5d11

Download Submit
C:\Users\Admin\AppData\Local\Temp\mgavd.exe

MD5
1738f16649edcdc550f3e20daa46eafc

SHA1
5368d6a6a275a46f5db8bc32a918555321d64a63

SHA256
668cc6abe5a037b7570fe87a8f1f8aa0e31da4479e7f9ebf188462176d889a35

SHA512
d0b348417cb75064e2553b17b0252d05f18bd76491a2c4a90202f21f875b50d3f097933e67c1cb67e6e2be320ca6080ba9120a118677a2df563f0e3dbfe61b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\mgavd.exe

MD5
1738f16649edcdc550f3e20daa46eafc

SHA1
5368d6a6a275a46f5db8bc32a918555321d64a63

SHA256
668cc6abe5a037b7570fe87a8f1f8aa0e31da4479e7f9ebf188462176d889a35

SHA512
d0b348417cb75064e2553b17b0252d05f18bd76491a2c4a90202f21f875b50d3f097933e67c1cb67e6e2be320ca6080ba9120a118677a2df563f0e3dbfe61b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\mgavd.exe

MD5
1738f16649edcdc550f3e20daa46eafc

SHA1
5368d6a6a275a46f5db8bc32a918555321d64a63

SHA256
668cc6abe5a037b7570fe87a8f1f8aa0e31da4479e7f9ebf188462176d889a35

SHA512
d0b348417cb75064e2553b17b0252d05f18bd76491a2c4a90202f21f875b50d3f097933e67c1cb67e6e2be320ca6080ba9120a118677a2df563f0e3dbfe61b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\qkiged

MD5
9b99f44011ecc5da234e3f81f9623261

SHA1
1f0b6c9dcff5bc24595fc35d775713dc6f5cce7f

SHA256
7014625142806826e7427ec69626abe3d15ce7b21286881eb8c48bcb96d0c47c

SHA512
1af1e48b36ad4584d4340e09344dba060974469e5defe7bef9b31e93a6d61b95276c5139f4ae2f5c4342806d75a240753440aaa0805e31406b46617093ff2268

Download Submit
memory/932-147-0x000001868B330000-0x000001868B340000-memory.dmp

Filesize
64KB

Download
memory/932-149-0x000001868E0A0000-0x000001868E0A4000-memory.dmp

Filesize
16KB

Download
memory/932-148-0x000001868B390000-0x000001868B3A0000-memory.dmp

Filesize
64KB

Download
memory/1804-143-0x0000000000EF0000-0x0000000000F19000-memory.dmp

Filesize
164KB

Download
memory/1804-142-0x0000000000370000-0x0000000000377000-memory.dmp

Filesize
28KB

Download
memory/1804-144-0x0000000001670000-0x00000000019BA000-memory.dmp

Filesize
3.3MB

Download
memory/1804-145-0x0000000001410000-0x00000000014A0000-memory.dmp

Filesize
576KB

Download
memory/2916-136-0x00000000009D0000-0x00000000009D2000-memory.dmp

Filesize
8KB

Download
memory/3020-146-0x0000000009290000-0x00000000093DD000-memory.dmp

Filesize
1.3MB

Download
memory/3020-141-0x0000000009140000-0x0000000009284000-memory.dmp

Filesize
1.3MB

Download
memory/4048-134-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4048-140-0x0000000000E90000-0x0000000000EA1000-memory.dmp

Filesize
68KB

Download
memory/4048-139-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/4048-138-0x00000000009D0000-0x0000000000D1A000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads