xloader | 109bfc4f1d73233b058db08b761ad7c77a7bc43bfe2b10a71614e536c2e89d3a

General

Target

INV15420.exe
Size

42KB
MD5

a17204c4cc765969839d22f78bc125bb
SHA1

7f29c80d2fbc4c4a73f65684fb689543e202d684
SHA256

109bfc4f1d73233b058db08b761ad7c77a7bc43bfe2b10a71614e536c2e89d3a
SHA512

950daa0ff2917f37d71f84bcac7df96c856d0966338b563f480c92d59343938441be0ff93d8801a4dfdc5a4542b3f5b39a5ee9926e9be5b6a498f7e372da6f91

Score

10^/10

xloader ahc8 loader persistence rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1240-61-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/984-68-0x00000000000C0000-0x00000000000E9000-memory.dmp	xloader

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wininit.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wininit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\UP-T0HTHUJS = "C:\\Program Files (x86)\\Xmx6hz\\Cookiesd2dlw8lp.exe"	wininit.exe

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

Cookiesd2dlw8lp.exeCookiesd2dlw8lp.exe

pid process

1668 Cookiesd2dlw8lp.exe
860 Cookiesd2dlw8lp.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

508 cmd.exe

pid	process
1668	Cookiesd2dlw8lp.exe
860	Cookiesd2dlw8lp.exe

pid	process
508	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

INV15420.exeINV15420.exewininit.exeCookiesd2dlw8lp.exe

description	pid	process	target process
PID 1208 set thread context of 1240	1208	INV15420.exe	INV15420.exe
PID 1240 set thread context of 1404	1240	INV15420.exe	Explorer.EXE
PID 984 set thread context of 1404	984	wininit.exe	Explorer.EXE
PID 1668 set thread context of 860	1668	Cookiesd2dlw8lp.exe	Cookiesd2dlw8lp.exe

Drops file in Program Files directory 2 IoCs

Processes:

wininit.exeExplorer.EXE

description	ioc	process
File opened for modification	C:\Program Files (x86)\Xmx6hz\Cookiesd2dlw8lp.exe	wininit.exe
File created	C:\Program Files (x86)\Xmx6hz\Cookiesd2dlw8lp.exe	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

wininit.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-1405931862-909307831-4085185274-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wininit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

INV15420.exewininit.exe

pid	process
1240	INV15420.exe
1240	INV15420.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe
984	wininit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1404 Explorer.EXE
Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

INV15420.exewininit.exe

pid process

1240 INV15420.exe
1240 INV15420.exe
1240 INV15420.exe
984 wininit.exe
984 wininit.exe
984 wininit.exe
984 wininit.exe

pid	process
1404	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

INV15420.exeINV15420.exewininit.exeExplorer.EXECookiesd2dlw8lp.exeCookiesd2dlw8lp.exe

description	pid	process
Token: SeDebugPrivilege	1208	INV15420.exe
Token: SeDebugPrivilege	1240	INV15420.exe
Token: SeDebugPrivilege	984	wininit.exe
Token: SeShutdownPrivilege	1404	Explorer.EXE
Token: SeDebugPrivilege	1668	Cookiesd2dlw8lp.exe
Token: SeDebugPrivilege	860	Cookiesd2dlw8lp.exe
Token: SeShutdownPrivilege	1404	Explorer.EXE
Token: SeShutdownPrivilege	1404	Explorer.EXE
Token: SeShutdownPrivilege	1404	Explorer.EXE
Token: SeShutdownPrivilege	1404	Explorer.EXE
Token: SeShutdownPrivilege	1404	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1404 Explorer.EXE
1404 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1404 Explorer.EXE
1404 Explorer.EXE

pid	process
1404	Explorer.EXE
1404	Explorer.EXE

pid	process
1404	Explorer.EXE
1404	Explorer.EXE

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

INV15420.exeExplorer.EXEwininit.exeCookiesd2dlw8lp.exe

description	pid	process	target process
PID 1208 wrote to memory of 1240	1208	INV15420.exe	INV15420.exe
PID 1208 wrote to memory of 1240	1208	INV15420.exe	INV15420.exe
PID 1208 wrote to memory of 1240	1208	INV15420.exe	INV15420.exe
PID 1208 wrote to memory of 1240	1208	INV15420.exe	INV15420.exe
PID 1208 wrote to memory of 1240	1208	INV15420.exe	INV15420.exe
PID 1208 wrote to memory of 1240	1208	INV15420.exe	INV15420.exe
PID 1208 wrote to memory of 1240	1208	INV15420.exe	INV15420.exe
PID 1404 wrote to memory of 984	1404	Explorer.EXE	wininit.exe
PID 1404 wrote to memory of 984	1404	Explorer.EXE	wininit.exe
PID 1404 wrote to memory of 984	1404	Explorer.EXE	wininit.exe
PID 1404 wrote to memory of 984	1404	Explorer.EXE	wininit.exe
PID 984 wrote to memory of 508	984	wininit.exe	cmd.exe
PID 984 wrote to memory of 508	984	wininit.exe	cmd.exe
PID 984 wrote to memory of 508	984	wininit.exe	cmd.exe
PID 984 wrote to memory of 508	984	wininit.exe	cmd.exe
PID 984 wrote to memory of 1616	984	wininit.exe	Firefox.exe
PID 984 wrote to memory of 1616	984	wininit.exe	Firefox.exe
PID 984 wrote to memory of 1616	984	wininit.exe	Firefox.exe
PID 984 wrote to memory of 1616	984	wininit.exe	Firefox.exe
PID 1404 wrote to memory of 1668	1404	Explorer.EXE	Cookiesd2dlw8lp.exe
PID 1404 wrote to memory of 1668	1404	Explorer.EXE	Cookiesd2dlw8lp.exe
PID 1404 wrote to memory of 1668	1404	Explorer.EXE	Cookiesd2dlw8lp.exe
PID 1404 wrote to memory of 1668	1404	Explorer.EXE	Cookiesd2dlw8lp.exe
PID 1668 wrote to memory of 860	1668	Cookiesd2dlw8lp.exe	Cookiesd2dlw8lp.exe
PID 1668 wrote to memory of 860	1668	Cookiesd2dlw8lp.exe	Cookiesd2dlw8lp.exe
PID 1668 wrote to memory of 860	1668	Cookiesd2dlw8lp.exe	Cookiesd2dlw8lp.exe
PID 1668 wrote to memory of 860	1668	Cookiesd2dlw8lp.exe	Cookiesd2dlw8lp.exe
PID 1668 wrote to memory of 860	1668	Cookiesd2dlw8lp.exe	Cookiesd2dlw8lp.exe
PID 1668 wrote to memory of 860	1668	Cookiesd2dlw8lp.exe	Cookiesd2dlw8lp.exe
PID 1668 wrote to memory of 860	1668	Cookiesd2dlw8lp.exe	Cookiesd2dlw8lp.exe
PID 984 wrote to memory of 1616	984	wininit.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1404

C:\Users\Admin\AppData\Local\Temp\INV15420.exe
"C:\Users\Admin\AppData\Local\Temp\INV15420.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208

C:\Users\Admin\AppData\Local\Temp\INV15420.exe
"C:\Users\Admin\AppData\Local\Temp\INV15420.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Windows\SysWOW64\wininit.exe
"C:\Windows\SysWOW64\wininit.exe"
2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\INV15420.exe"
3⤵
- Deletes itself
PID:508

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:1616

C:\Program Files (x86)\Xmx6hz\Cookiesd2dlw8lp.exe
"C:\Program Files (x86)\Xmx6hz\Cookiesd2dlw8lp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668

C:\Program Files (x86)\Xmx6hz\Cookiesd2dlw8lp.exe
"C:\Program Files (x86)\Xmx6hz\Cookiesd2dlw8lp.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:860

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Xmx6hz\Cookiesd2dlw8lp.exe
MD5
a17204c4cc765969839d22f78bc125bb

SHA1
7f29c80d2fbc4c4a73f65684fb689543e202d684

SHA256
109bfc4f1d73233b058db08b761ad7c77a7bc43bfe2b10a71614e536c2e89d3a

SHA512
950daa0ff2917f37d71f84bcac7df96c856d0966338b563f480c92d59343938441be0ff93d8801a4dfdc5a4542b3f5b39a5ee9926e9be5b6a498f7e372da6f91

Download Submit
C:\Program Files (x86)\Xmx6hz\Cookiesd2dlw8lp.exe
MD5
a17204c4cc765969839d22f78bc125bb

SHA1
7f29c80d2fbc4c4a73f65684fb689543e202d684

SHA256
109bfc4f1d73233b058db08b761ad7c77a7bc43bfe2b10a71614e536c2e89d3a

SHA512
950daa0ff2917f37d71f84bcac7df96c856d0966338b563f480c92d59343938441be0ff93d8801a4dfdc5a4542b3f5b39a5ee9926e9be5b6a498f7e372da6f91

Download Submit
C:\Program Files (x86)\Xmx6hz\Cookiesd2dlw8lp.exe
MD5
a17204c4cc765969839d22f78bc125bb

SHA1
7f29c80d2fbc4c4a73f65684fb689543e202d684

SHA256
109bfc4f1d73233b058db08b761ad7c77a7bc43bfe2b10a71614e536c2e89d3a

SHA512
950daa0ff2917f37d71f84bcac7df96c856d0966338b563f480c92d59343938441be0ff93d8801a4dfdc5a4542b3f5b39a5ee9926e9be5b6a498f7e372da6f91

Download Submit
memory/860-81-0x0000000000A40000-0x0000000000D43000-memory.dmp

Filesize
3.0MB

Download
memory/984-67-0x0000000000E70000-0x0000000000E8A000-memory.dmp

Filesize
104KB

Download
memory/984-72-0x0000000075CC1000-0x0000000075CC3000-memory.dmp

Filesize
8KB

Download
memory/984-70-0x0000000000960000-0x00000000009F0000-memory.dmp

Filesize
576KB

Download
memory/984-69-0x0000000000A40000-0x0000000000D43000-memory.dmp

Filesize
3.0MB

Download
memory/984-68-0x00000000000C0000-0x00000000000E9000-memory.dmp

Filesize
164KB

Download
memory/1208-58-0x0000000000710000-0x0000000000718000-memory.dmp

Filesize
32KB

Download
memory/1208-57-0x0000000000510000-0x0000000000526000-memory.dmp

Filesize
88KB

Download
memory/1208-55-0x00000000744DE000-0x00000000744DF000-memory.dmp

Filesize
4KB

Download
memory/1208-54-0x0000000000D00000-0x0000000000D10000-memory.dmp

Filesize
64KB

Download
memory/1208-56-0x0000000004880000-0x0000000004881000-memory.dmp

Filesize
4KB

Download
memory/1240-62-0x00000000009E0000-0x0000000000CE3000-memory.dmp

Filesize
3.0MB

Download
memory/1240-65-0x0000000000140000-0x0000000000151000-memory.dmp

Filesize
68KB

Download
memory/1240-59-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1240-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1240-64-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/1240-61-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1404-71-0x00000000072C0000-0x0000000007420000-memory.dmp

Filesize
1.4MB

Download
memory/1404-66-0x0000000007000000-0x000000000718B000-memory.dmp

Filesize
1.5MB

Download
memory/1668-75-0x0000000073FCE000-0x0000000073FCF000-memory.dmp

Filesize
4KB

Download
memory/1668-76-0x0000000000F10000-0x0000000000F20000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads