xloader | b696aa2ab2bffe77db1a4623aa2769e7941af4ea6286f026ad09365180dd54ab

Analysis

max time kernel
4294207s
max time network
150s
platform
windows7_x64
resource
win7-20220223-en
submitted
01/03/2022, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Purchase Order.exe
Size 661KB
Sample220301-1d7casbfc7
SHA256 b696aa2ab2bffe77db1a4623aa2769e7941af4ea6286f026ad09365180dd54ab
MD5 9545719421db1d6a54358433b78f12c3
SHA1 2500f40c99e21fdb99b42a3d3cd38662b204cb5d
SHA512 a82b9a5fe20b1cc0ab109559bf090b1de2563f497aabb61e822aa6533ea688afe9a6e68892674d54b1d0c21cac7d8b0fdae50e08c70feff3e13efb4da5446e58
MD5 SHA1 SHA512

Score

10^/10

xloader b8eu loader rat

Malware Config

Extracted

Family

xloader

Version

Campaign

b8eu

Decoy

coeusconsultancy.com
allutravel.com
frustratedsportsfan.com
notch.host
cvkur.com
dunamisathletics.com
citycourtlafayetteclass.com
tastingpay.com
beriteautoglass.com
mexicanaenergy.com
karaokepkllkb.xyz
equiposymaquinasparamineria.com
fsmgayrimenkulbursa.com
femmequidanseaveclalune.com
frfrjrbfkfncifnsnqwnxbcb.com
jmwxhsbktiyq7.xyz
nevirame.com
wppaulwriter.com
anandiaper.xyz
krasamart.com
osakebatake.com
procofun.com
makingcash4u.online
tbrme.plus
nfqch.com
regitconvention.com
lawyer-kuchukov.online
encontrartrabajosbuscarmex.com
robyngauer.com
awarity.agency
holyhirschsprungs.com
katiesmobilestyling.com
rj3143.com
theheroinejourney.net
jktechsupport.com
smartlifestickpack.net
getelements.today
awaknofficial.com
officereinstatementsg.com
cgloansllc.com
infra-hiit.com
additionstore.com
zerotocloudengineers.com
rezendetube.com
tarotgatahechizos.com
tanakaya-jp.com
krakow-nagromadzenie.space
frontpage.asia
exclusivedigitalprinting.com
bacnebuster.com
zbhuizhu.com
amenosu.com
sgparking.com
ynov-lille.com
kazamiharutoki.com
nottryingdoing.com
healthyeatingbooknow.com
thevisionagency.net
bjhaqx.com
qhzhuhang.com
ferryal.xyz
diglib.info
soulshine.today
mamazdenka.com
millennialsofacertainage.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1380-62-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1380-64-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1252-70-0x0000000000110000-0x0000000000139000-memory.dmp	xloader

Deletes itself 1 IoCs

pid	Process
1500	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1220 set thread context of 1380	1220	Purchase Order.exe	30
PID 1380 set thread context of 1408	1380	Purchase Order.exe	14
PID 1252 set thread context of 1408	1252	NAPSTAT.EXE	14

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1220	Purchase Order.exe
1220	Purchase Order.exe
1220	Purchase Order.exe
1380	Purchase Order.exe
1380	Purchase Order.exe
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1380	Purchase Order.exe
1380	Purchase Order.exe
1380	Purchase Order.exe
1252	NAPSTAT.EXE
1252	NAPSTAT.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1220	Purchase Order.exe
Token: SeDebugPrivilege	1380	Purchase Order.exe
Token: SeDebugPrivilege	1252	NAPSTAT.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1408	Explorer.EXE
1408	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1408	Explorer.EXE
1408	Explorer.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 1216	1220	Purchase Order.exe	27
PID 1220 wrote to memory of 1216	1220	Purchase Order.exe	27
PID 1220 wrote to memory of 1216	1220	Purchase Order.exe	27
PID 1220 wrote to memory of 1216	1220	Purchase Order.exe	27
PID 1220 wrote to memory of 1152	1220	Purchase Order.exe	28
PID 1220 wrote to memory of 1152	1220	Purchase Order.exe	28
PID 1220 wrote to memory of 1152	1220	Purchase Order.exe	28
PID 1220 wrote to memory of 1152	1220	Purchase Order.exe	28
PID 1220 wrote to memory of 860	1220	Purchase Order.exe	29
PID 1220 wrote to memory of 860	1220	Purchase Order.exe	29
PID 1220 wrote to memory of 860	1220	Purchase Order.exe	29
PID 1220 wrote to memory of 860	1220	Purchase Order.exe	29
PID 1220 wrote to memory of 1380	1220	Purchase Order.exe	30
PID 1220 wrote to memory of 1380	1220	Purchase Order.exe	30
PID 1220 wrote to memory of 1380	1220	Purchase Order.exe	30
PID 1220 wrote to memory of 1380	1220	Purchase Order.exe	30
PID 1220 wrote to memory of 1380	1220	Purchase Order.exe	30
PID 1220 wrote to memory of 1380	1220	Purchase Order.exe	30
PID 1220 wrote to memory of 1380	1220	Purchase Order.exe	30
PID 1408 wrote to memory of 1252	1408	Explorer.EXE	31
PID 1408 wrote to memory of 1252	1408	Explorer.EXE	31
PID 1408 wrote to memory of 1252	1408	Explorer.EXE	31
PID 1408 wrote to memory of 1252	1408	Explorer.EXE	31
PID 1252 wrote to memory of 1500	1252	NAPSTAT.EXE	32
PID 1252 wrote to memory of 1500	1252	NAPSTAT.EXE	32
PID 1252 wrote to memory of 1500	1252	NAPSTAT.EXE	32
PID 1252 wrote to memory of 1500	1252	NAPSTAT.EXE	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
    "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
    "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
    3⤵
    PID:1152
- - C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
    "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
    3⤵
    PID:860
- - C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe
    "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1380
- C:\Windows\SysWOW64\NAPSTAT.EXE
  "C:\Windows\SysWOW64\NAPSTAT.EXE"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"
    3⤵
    - Deletes itself
    PID:1500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-54-0x00000000001B0000-0x000000000025C000-memory.dmp

Download

memory/1220-55-0x0000000074DEE000-0x0000000074DEF000-memory.dmp

Download

memory/1220-56-0x0000000004560000-0x0000000004561000-memory.dmp

Download

memory/1220-57-0x00000000002D0000-0x00000000002E0000-memory.dmp

Download

memory/1220-58-0x0000000005F50000-0x0000000005FFE000-memory.dmp

Download

memory/1220-59-0x0000000002170000-0x00000000021A0000-memory.dmp

Download

memory/1252-70-0x0000000000110000-0x0000000000139000-memory.dmp

Download

memory/1252-69-0x0000000000950000-0x0000000000996000-memory.dmp

Download

memory/1252-74-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Download

memory/1252-72-0x0000000001E30000-0x0000000001EC0000-memory.dmp

Download

memory/1252-71-0x0000000002070000-0x0000000002373000-memory.dmp

Download

memory/1380-65-0x0000000000960000-0x0000000000C63000-memory.dmp

Download

memory/1380-66-0x000000000041D000-0x000000000041E000-memory.dmp

Download

memory/1380-67-0x0000000000150000-0x0000000000161000-memory.dmp

Download

memory/1380-60-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1380-61-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1380-64-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1380-62-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1408-68-0x00000000049D0000-0x0000000004AC5000-memory.dmp

Download

memory/1408-73-0x0000000004E30000-0x0000000004F88000-memory.dmp

Download