xloader | 0abb22830a161d2009ae8067a6807250990022c039c3006dc13b3ca4af789f67

General

Target

DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
Size

17KB
MD5

23c8ac1dece030f7b6a967116135a2bd
SHA1

fcd3afc6427bf06794a34ba8fa8101a210d83453
SHA256

0abb22830a161d2009ae8067a6807250990022c039c3006dc13b3ca4af789f67
SHA512

0027b3b16d9b0f9fce4416264f1999d1b5ba97b27a7a807858745f81cde0b581a2e2d8a5449067b435b06f1f2a64cb512196d34aac15ea617ec8da8c894bbbf2

Score

10^/10

xloader po6r loader persistence rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

po6r

Decoy

jnhuichuangxin.com

mubashir.art

extol.design

doyyindh.xyz

milanoautoexperts.com

4thefringe.com

453511.com

sellathonautocredit.com

velgian.com

6672pk.com

wodeluzhou.com

sumiyoshiku-hizaita.xyz

imoveldeprimeira.com

dgjssp.com

endokc.com

side-clicks.com

cashndashfinancial.com

vanhemelryck.info

agamitrading.com

woofgang.xyz

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\fine.exe\","	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/784-62-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1744-70-0x0000000000090000-0x00000000000B9000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

Processes:

DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exeDHL - OVERDUE ACCOUNT NOTICE - 1301474408.exemsiexec.exe

description	pid	process	target process
PID 944 set thread context of 784	944	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 784 set thread context of 1316	784	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	Explorer.EXE
PID 1744 set thread context of 1316	1744	msiexec.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exeDHL - OVERDUE ACCOUNT NOTICE - 1301474408.exemsiexec.exe

pid	process
944	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
944	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
944	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
784	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
784	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
1744	msiexec.exe
1744	msiexec.exe
1744	msiexec.exe
1744	msiexec.exe
1744	msiexec.exe
1744	msiexec.exe
1744	msiexec.exe
1744	msiexec.exe
1744	msiexec.exe
1744	msiexec.exe
1744	msiexec.exe
1744	msiexec.exe
1744	msiexec.exe
1744	msiexec.exe
1744	msiexec.exe
1744	msiexec.exe
1744	msiexec.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exemsiexec.exe

pid	process
784	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
784	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
784	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
1744	msiexec.exe
1744	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exeDHL - OVERDUE ACCOUNT NOTICE - 1301474408.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	944	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
Token: SeDebugPrivilege	784	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
Token: SeDebugPrivilege	1744	msiexec.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exeExplorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1316

C:\Users\Admin\AppData\Local\Temp\DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
"C:\Users\Admin\AppData\Local\Temp\DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe"
2⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944

C:\Users\Admin\AppData\Local\Temp\DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
"C:\Users\Admin\AppData\Local\Temp\DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe"
3⤵
PID:1248

C:\Users\Admin\AppData\Local\Temp\DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
"C:\Users\Admin\AppData\Local\Temp\DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:784

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/784-66-0x0000000000290000-0x00000000002A1000-memory.dmp

Filesize
68KB

Download
memory/784-64-0x00000000008D0000-0x0000000000BD3000-memory.dmp

Filesize
3.0MB

Download
memory/784-65-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/784-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/784-61-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/944-58-0x0000000005430000-0x00000000054E6000-memory.dmp

Filesize
728KB

Download
memory/944-59-0x0000000005210000-0x000000000525C000-memory.dmp

Filesize
304KB

Download
memory/944-54-0x0000000001090000-0x000000000109A000-memory.dmp

Filesize
40KB

Download
memory/944-57-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/944-56-0x0000000076911000-0x0000000076913000-memory.dmp

Filesize
8KB

Download
memory/944-55-0x000000007439E000-0x000000007439F000-memory.dmp

Filesize
4KB

Download
memory/1316-67-0x0000000005F10000-0x000000000601F000-memory.dmp

Filesize
1.1MB

Download
memory/1316-73-0x0000000006320000-0x00000000063D1000-memory.dmp

Filesize
708KB

Download
memory/1744-70-0x0000000000090000-0x00000000000B9000-memory.dmp

Filesize
164KB

Download
memory/1744-69-0x0000000000520000-0x0000000000534000-memory.dmp

Filesize
80KB

Download
memory/1744-71-0x00000000021A0000-0x00000000024A3000-memory.dmp

Filesize
3.0MB

Download
memory/1744-72-0x0000000000470000-0x0000000000500000-memory.dmp

Filesize
576KB

Download

description	pid	process	target process
PID 944 wrote to memory of 1248	944	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 944 wrote to memory of 1248	944	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 944 wrote to memory of 1248	944	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 944 wrote to memory of 1248	944	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 944 wrote to memory of 784	944	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 944 wrote to memory of 784	944	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 944 wrote to memory of 784	944	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 944 wrote to memory of 784	944	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 944 wrote to memory of 784	944	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 944 wrote to memory of 784	944	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 944 wrote to memory of 784	944	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe	DHL - OVERDUE ACCOUNT NOTICE - 1301474408.exe
PID 1316 wrote to memory of 1744	1316	Explorer.EXE	msiexec.exe
PID 1316 wrote to memory of 1744	1316	Explorer.EXE	msiexec.exe
PID 1316 wrote to memory of 1744	1316	Explorer.EXE	msiexec.exe
PID 1316 wrote to memory of 1744	1316	Explorer.EXE	msiexec.exe
PID 1316 wrote to memory of 1744	1316	Explorer.EXE	msiexec.exe
PID 1316 wrote to memory of 1744	1316	Explorer.EXE	msiexec.exe
PID 1316 wrote to memory of 1744	1316	Explorer.EXE	msiexec.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads