xloader | d35376874dfae81b9e386ce6fc1e64aa26eb486fb7f392b0b8e88835c9e016c5

General

Target

Odeme FX56437.exe
Size

302KB
MD5

83b5706dea80505bb1acc65d8e021391
SHA1

b9e074b6fef1ae60be115f4f3c3e9677777d85fe
SHA256

d35376874dfae81b9e386ce6fc1e64aa26eb486fb7f392b0b8e88835c9e016c5
SHA512

8c9fb64c4397ba1314ba45ee3e35b72ea027b6f3b4da36d5b4fa9f1041b94d3776fe4ab119f3ab065b13e0a617413f16bb9ccbc25bd81de4354439580cc7ad0d

Score

10^/10

xloader cbgo loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

cbgo

Decoy

santesha.com

britneysbeautybar.com

sh-cy17.com

jeffcarveragency.com

3117111.com

sobrehosting.net

ddm123.xyz

toxcompliance.com

auditorydesigns.com

vliftfacial.com

ielhii.com

naameliss.com

ritualchariot.com

solchange.com

quatre-vingts.design

lawnmowermashine.com

braceletsstore.net

admappy.com

tollivercoltd.com

vaidix.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/992-63-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/992-67-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1384-73-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Executes dropped EXE 2 IoCs

Processes:

htrxobyvyr.exehtrxobyvyr.exe

pid process

976 htrxobyvyr.exe
992 htrxobyvyr.exe
Loads dropped DLL 2 IoCs

Processes:

Odeme FX56437.exehtrxobyvyr.exe

pid process

1192 Odeme FX56437.exe
976 htrxobyvyr.exe

pid	process
976	htrxobyvyr.exe
992	htrxobyvyr.exe

pid	process
1192	Odeme FX56437.exe
976	htrxobyvyr.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

htrxobyvyr.exehtrxobyvyr.exechkdsk.exe

description	pid	process	target process
PID 976 set thread context of 992	976	htrxobyvyr.exe	htrxobyvyr.exe
PID 992 set thread context of 1448	992	htrxobyvyr.exe	Explorer.EXE
PID 1384 set thread context of 1448	1384	chkdsk.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

chkdsk.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

htrxobyvyr.exechkdsk.exe

pid	process
992	htrxobyvyr.exe
992	htrxobyvyr.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe
1384	chkdsk.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1448 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

htrxobyvyr.exechkdsk.exe

pid process

992 htrxobyvyr.exe
992 htrxobyvyr.exe
992 htrxobyvyr.exe
1384 chkdsk.exe
1384 chkdsk.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

htrxobyvyr.exechkdsk.exe

description pid process

Token: SeDebugPrivilege 992 htrxobyvyr.exe
Token: SeDebugPrivilege 1384 chkdsk.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1448 Explorer.EXE
1448 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1448 Explorer.EXE
1448 Explorer.EXE

pid	process
1448	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	992	htrxobyvyr.exe
Token: SeDebugPrivilege	1384	chkdsk.exe

pid	process
1448	Explorer.EXE
1448	Explorer.EXE

pid	process
1448	Explorer.EXE
1448	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

Odeme FX56437.exehtrxobyvyr.exeExplorer.EXEchkdsk.exe

description	pid	process	target process
PID 1192 wrote to memory of 976	1192	Odeme FX56437.exe	htrxobyvyr.exe
PID 1192 wrote to memory of 976	1192	Odeme FX56437.exe	htrxobyvyr.exe
PID 1192 wrote to memory of 976	1192	Odeme FX56437.exe	htrxobyvyr.exe
PID 1192 wrote to memory of 976	1192	Odeme FX56437.exe	htrxobyvyr.exe
PID 976 wrote to memory of 992	976	htrxobyvyr.exe	htrxobyvyr.exe
PID 976 wrote to memory of 992	976	htrxobyvyr.exe	htrxobyvyr.exe
PID 976 wrote to memory of 992	976	htrxobyvyr.exe	htrxobyvyr.exe
PID 976 wrote to memory of 992	976	htrxobyvyr.exe	htrxobyvyr.exe
PID 976 wrote to memory of 992	976	htrxobyvyr.exe	htrxobyvyr.exe
PID 976 wrote to memory of 992	976	htrxobyvyr.exe	htrxobyvyr.exe
PID 976 wrote to memory of 992	976	htrxobyvyr.exe	htrxobyvyr.exe
PID 1448 wrote to memory of 1384	1448	Explorer.EXE	chkdsk.exe
PID 1448 wrote to memory of 1384	1448	Explorer.EXE	chkdsk.exe
PID 1448 wrote to memory of 1384	1448	Explorer.EXE	chkdsk.exe
PID 1448 wrote to memory of 1384	1448	Explorer.EXE	chkdsk.exe
PID 1384 wrote to memory of 392	1384	chkdsk.exe	cmd.exe
PID 1384 wrote to memory of 392	1384	chkdsk.exe	cmd.exe
PID 1384 wrote to memory of 392	1384	chkdsk.exe	cmd.exe
PID 1384 wrote to memory of 392	1384	chkdsk.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1448

C:\Users\Admin\AppData\Local\Temp\Odeme FX56437.exe
"C:\Users\Admin\AppData\Local\Temp\Odeme FX56437.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1192

C:\Users\Admin\AppData\Local\Temp\htrxobyvyr.exe
C:\Users\Admin\AppData\Local\Temp\htrxobyvyr.exe C:\Users\Admin\AppData\Local\Temp\ctpfsqj
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:976

C:\Users\Admin\AppData\Local\Temp\htrxobyvyr.exe
C:\Users\Admin\AppData\Local\Temp\htrxobyvyr.exe C:\Users\Admin\AppData\Local\Temp\ctpfsqj
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:992

C:\Windows\SysWOW64\chkdsk.exe
"C:\Windows\SysWOW64\chkdsk.exe"
2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\htrxobyvyr.exe"
3⤵
PID:392

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ctpfsqj
MD5
c0bef8671acfe0c6ee479e9364632e19

SHA1
c5b634e259d69b0b669dffd61d9a865339d641a3

SHA256
7957c9419ad422f9d740136c97bd35d41d821bfa30760dd78fe6f8b7b16178d2

SHA512
38674c68a2e7e5306075cbc8fcc639794e26ee57cc60775e53fec613d931f0590fbbb2707a8f2639739a7b295c68aaad42681b80915b04693674130da1c20d20

Download Submit
C:\Users\Admin\AppData\Local\Temp\htrxobyvyr.exe
MD5
25518f9abe65d0343765d5b3f3de2705

SHA1
168e7da4184dbad5abb854b6eb26e1a7ba70aa91

SHA256
8f38f8989c42a7e39bfdb25ea130d327f02af00e788a7d6dd6cfabf615f13c2a

SHA512
b129e49458a93a9eeee3820f85d449172e6572f24f22412a3249195fc829a2207fe606604bb67b0159bfe46a4455b63d0c080b745fc1fca140457e43ffae9f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\htrxobyvyr.exe
MD5
25518f9abe65d0343765d5b3f3de2705

SHA1
168e7da4184dbad5abb854b6eb26e1a7ba70aa91

SHA256
8f38f8989c42a7e39bfdb25ea130d327f02af00e788a7d6dd6cfabf615f13c2a

SHA512
b129e49458a93a9eeee3820f85d449172e6572f24f22412a3249195fc829a2207fe606604bb67b0159bfe46a4455b63d0c080b745fc1fca140457e43ffae9f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\htrxobyvyr.exe
MD5
25518f9abe65d0343765d5b3f3de2705

SHA1
168e7da4184dbad5abb854b6eb26e1a7ba70aa91

SHA256
8f38f8989c42a7e39bfdb25ea130d327f02af00e788a7d6dd6cfabf615f13c2a

SHA512
b129e49458a93a9eeee3820f85d449172e6572f24f22412a3249195fc829a2207fe606604bb67b0159bfe46a4455b63d0c080b745fc1fca140457e43ffae9f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\r0ndflw3rulmn8cq
MD5
f1f45b8216835bd47d25c40b5690bda8

SHA1
02e577686510bfc7bcc88db1322eba5e798a762f

SHA256
c59b71cb4248ced4e737a53769cf1035458eec832f449095d4fc97ab57631efb

SHA512
3f9393f79e5c6304c663d7fe28f89c1d68ece71ce9db0e16e686377959d0a71ec9a98bcbe6e2474db74e5eb5b592c774d5208b3fbd8cd157c059bb2f70c09698

Download Submit
\Users\Admin\AppData\Local\Temp\htrxobyvyr.exe
MD5
25518f9abe65d0343765d5b3f3de2705

SHA1
168e7da4184dbad5abb854b6eb26e1a7ba70aa91

SHA256
8f38f8989c42a7e39bfdb25ea130d327f02af00e788a7d6dd6cfabf615f13c2a

SHA512
b129e49458a93a9eeee3820f85d449172e6572f24f22412a3249195fc829a2207fe606604bb67b0159bfe46a4455b63d0c080b745fc1fca140457e43ffae9f84

Download Submit
\Users\Admin\AppData\Local\Temp\htrxobyvyr.exe
MD5
25518f9abe65d0343765d5b3f3de2705

SHA1
168e7da4184dbad5abb854b6eb26e1a7ba70aa91

SHA256
8f38f8989c42a7e39bfdb25ea130d327f02af00e788a7d6dd6cfabf615f13c2a

SHA512
b129e49458a93a9eeee3820f85d449172e6572f24f22412a3249195fc829a2207fe606604bb67b0159bfe46a4455b63d0c080b745fc1fca140457e43ffae9f84

Download Submit
memory/976-66-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download
memory/992-67-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/992-63-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/992-69-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/992-68-0x0000000000930000-0x0000000000C33000-memory.dmp

Filesize
3.0MB

Download
memory/992-70-0x0000000000140000-0x0000000000151000-memory.dmp

Filesize
68KB

Download
memory/1192-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1384-72-0x00000000005F0000-0x00000000005F7000-memory.dmp

Filesize
28KB

Download
memory/1384-73-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/1384-74-0x00000000020D0000-0x00000000023D3000-memory.dmp

Filesize
3.0MB

Download
memory/1384-75-0x0000000001E00000-0x0000000001E90000-memory.dmp

Filesize
576KB

Download
memory/1448-71-0x0000000006730000-0x00000000068D5000-memory.dmp

Filesize
1.6MB

Download
memory/1448-76-0x0000000008D20000-0x0000000008E35000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads