xloader | 35295675b2fbd8ff9900336325e3324270f083705fd0cf51f4ef28763430cdd6

General

Target

INV21029.exe
Size

577KB
MD5

740dd9c14dea0b98df6ad434abfe789e
SHA1

cbec4d898e68c12fb7dcaddb17d0aca16e8e0e7b
SHA256

35295675b2fbd8ff9900336325e3324270f083705fd0cf51f4ef28763430cdd6
SHA512

66041e42091e83889a6da93c4242a01a0a3122774dc2db8baf909fb0ec6b0d6e847183ac92a24f2ca99f99de7dd4abddddda4a908887f354e3a333202bc0a66e

Score

10^/10

xloader ahc8 loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3364-122-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/3364-127-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/3056-131-0x0000000000CC0000-0x0000000000CE9000-memory.dmp	xloader

Executes dropped EXE 2 IoCs

Processes:

reqbqonire.exereqbqonire.exe

pid process

1828 reqbqonire.exe
3364 reqbqonire.exe

pid	process
1828	reqbqonire.exe
3364	reqbqonire.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

reqbqonire.exereqbqonire.execmstp.exe

description	pid	process	target process
PID 1828 set thread context of 3364	1828	reqbqonire.exe	reqbqonire.exe
PID 3364 set thread context of 2876	3364	reqbqonire.exe	Explorer.EXE
PID 3056 set thread context of 2876	3056	cmstp.exe	Explorer.EXE

Drops file in Windows directory 2 IoCs

Processes:

taskmgr.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

Processes:

taskmgr.exereqbqonire.execmstp.exe

pid	process
2092	taskmgr.exe
2092	taskmgr.exe
3364	reqbqonire.exe
3364	reqbqonire.exe
3364	reqbqonire.exe
3364	reqbqonire.exe
3056	cmstp.exe
3056	cmstp.exe
3056	cmstp.exe
3056	cmstp.exe
3056	cmstp.exe
3056	cmstp.exe
3056	cmstp.exe
3056	cmstp.exe
3056	cmstp.exe
3056	cmstp.exe
3056	cmstp.exe
3056	cmstp.exe
3056	cmstp.exe
3056	cmstp.exe
3056	cmstp.exe
3056	cmstp.exe
3056	cmstp.exe
3056	cmstp.exe
2092	taskmgr.exe
2092	taskmgr.exe
3056	cmstp.exe
3056	cmstp.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
3056	cmstp.exe
3056	cmstp.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
3056	cmstp.exe
3056	cmstp.exe
2092	taskmgr.exe
2092	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2876 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

reqbqonire.execmstp.exe

pid process

3364 reqbqonire.exe
3364 reqbqonire.exe
3364 reqbqonire.exe
3056 cmstp.exe
3056 cmstp.exe

pid	process
2876	Explorer.EXE

pid	process
3364	reqbqonire.exe
3364	reqbqonire.exe
3364	reqbqonire.exe
3056	cmstp.exe
3056	cmstp.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

Processes:

taskmgr.exereqbqonire.execmstp.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	2092	taskmgr.exe
Token: SeSystemProfilePrivilege	2092	taskmgr.exe
Token: SeCreateGlobalPrivilege	2092	taskmgr.exe
Token: SeDebugPrivilege	3364	reqbqonire.exe
Token: SeDebugPrivilege	3056	cmstp.exe
Token: SeShutdownPrivilege	2876	Explorer.EXE
Token: SeCreatePagefilePrivilege	2876	Explorer.EXE
Token: SeShutdownPrivilege	2876	Explorer.EXE
Token: SeCreatePagefilePrivilege	2876	Explorer.EXE
Token: SeShutdownPrivilege	2876	Explorer.EXE
Token: SeCreatePagefilePrivilege	2876	Explorer.EXE
Token: SeShutdownPrivilege	2876	Explorer.EXE
Token: SeCreatePagefilePrivilege	2876	Explorer.EXE
Token: SeShutdownPrivilege	2876	Explorer.EXE
Token: SeCreatePagefilePrivilege	2876	Explorer.EXE
Token: SeShutdownPrivilege	2876	Explorer.EXE
Token: SeCreatePagefilePrivilege	2876	Explorer.EXE
Token: SeShutdownPrivilege	2876	Explorer.EXE
Token: SeCreatePagefilePrivilege	2876	Explorer.EXE
Token: SeShutdownPrivilege	2876	Explorer.EXE
Token: SeCreatePagefilePrivilege	2876	Explorer.EXE
Token: SeShutdownPrivilege	2876	Explorer.EXE
Token: SeCreatePagefilePrivilege	2876	Explorer.EXE
Token: SeShutdownPrivilege	2876	Explorer.EXE
Token: SeCreatePagefilePrivilege	2876	Explorer.EXE
Token: SeShutdownPrivilege	2876	Explorer.EXE
Token: SeCreatePagefilePrivilege	2876	Explorer.EXE
Token: SeShutdownPrivilege	2876	Explorer.EXE
Token: SeCreatePagefilePrivilege	2876	Explorer.EXE
Token: SeShutdownPrivilege	2876	Explorer.EXE
Token: SeCreatePagefilePrivilege	2876	Explorer.EXE

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

taskmgr.exeExplorer.EXE

pid	process
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2876	Explorer.EXE
2092	taskmgr.exe
2092	taskmgr.exe
2876	Explorer.EXE
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exeExplorer.EXE

pid	process
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2092	taskmgr.exe
2092	taskmgr.exe
2876	Explorer.EXE
2092	taskmgr.exe
2092	taskmgr.exe
2876	Explorer.EXE
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2092	taskmgr.exe
2876	Explorer.EXE
2876	Explorer.EXE
2092	taskmgr.exe
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE
2876	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

INV21029.exereqbqonire.exeExplorer.EXEcmstp.exe

description	pid	process	target process
PID 1240 wrote to memory of 1828	1240	INV21029.exe	reqbqonire.exe
PID 1240 wrote to memory of 1828	1240	INV21029.exe	reqbqonire.exe
PID 1240 wrote to memory of 1828	1240	INV21029.exe	reqbqonire.exe
PID 1828 wrote to memory of 3364	1828	reqbqonire.exe	reqbqonire.exe
PID 1828 wrote to memory of 3364	1828	reqbqonire.exe	reqbqonire.exe
PID 1828 wrote to memory of 3364	1828	reqbqonire.exe	reqbqonire.exe
PID 1828 wrote to memory of 3364	1828	reqbqonire.exe	reqbqonire.exe
PID 1828 wrote to memory of 3364	1828	reqbqonire.exe	reqbqonire.exe
PID 1828 wrote to memory of 3364	1828	reqbqonire.exe	reqbqonire.exe
PID 2876 wrote to memory of 3056	2876	Explorer.EXE	cmstp.exe
PID 2876 wrote to memory of 3056	2876	Explorer.EXE	cmstp.exe
PID 2876 wrote to memory of 3056	2876	Explorer.EXE	cmstp.exe
PID 3056 wrote to memory of 1272	3056	cmstp.exe	cmd.exe
PID 3056 wrote to memory of 1272	3056	cmstp.exe	cmd.exe
PID 3056 wrote to memory of 1272	3056	cmstp.exe	cmd.exe
PID 2876 wrote to memory of 204	2876	Explorer.EXE	chrome.exe
PID 2876 wrote to memory of 204	2876	Explorer.EXE	chrome.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876

C:\Users\Admin\AppData\Local\Temp\INV21029.exe
"C:\Users\Admin\AppData\Local\Temp\INV21029.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe C:\Users\Admin\AppData\Local\Temp\truuumm
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1828

C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe C:\Users\Admin\AppData\Local\Temp\truuumm
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3364

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
2⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2092

C:\Windows\SysWOW64\cmstp.exe
"C:\Windows\SysWOW64\cmstp.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe"
3⤵
PID:1272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
PID:204

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1djuqculeikkmhtz2x2
MD5
199f72b6103b1ad570f3a810d06c332a

SHA1
43b9341301394deec3c674cf98fc3c6cc629ee2b

SHA256
a61bbd1659ba2338fe6e4df411d709834285b54991c403ba07bc9459af5320fc

SHA512
0ce6be58193b0bcdccd003218597ce8f6bd0de35563c32d28c2e111903445f12ece5fa0a536dd2b79153b9c265c10a6ec17f8ef67b11edb95d155c0f502adeb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe
MD5
b83e207b80ad38dccaf5b38b9a64cf97

SHA1
a28cba27c256021902f8150d47ced82565bb8558

SHA256
97658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741

SHA512
190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe
MD5
b83e207b80ad38dccaf5b38b9a64cf97

SHA1
a28cba27c256021902f8150d47ced82565bb8558

SHA256
97658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741

SHA512
190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe
MD5
b83e207b80ad38dccaf5b38b9a64cf97

SHA1
a28cba27c256021902f8150d47ced82565bb8558

SHA256
97658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741

SHA512
190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\truuumm
MD5
0a99632c69bc8d3fe6231d0a50bff785

SHA1
ad875f4428f17d0474be5ee8667158bd14d10f22

SHA256
0a11eae20268581b0ad9c67defaf1a4dc4bf183ede922eca10c5da698eec8078

SHA512
93905216a40975163edfcc94cf3c55c40a27e4cf7143d028ef6c5caead6ceaaa1504bd4c5a05d043d61be3df08991ea7e1e8c98cdfafd9d8744ccacdc5d7de2f

Download Submit
memory/1828-124-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2876-134-0x0000000004AB0000-0x0000000004C10000-memory.dmp

Filesize
1.4MB

Download
memory/2876-129-0x0000000004980000-0x0000000004AA5000-memory.dmp

Filesize
1.1MB

Download
memory/3056-131-0x0000000000CC0000-0x0000000000CE9000-memory.dmp

Filesize
164KB

Download
memory/3056-133-0x0000000000F40000-0x0000000000FD0000-memory.dmp

Filesize
576KB

Download
memory/3056-132-0x0000000004580000-0x00000000048A0000-memory.dmp

Filesize
3.1MB

Download
memory/3056-130-0x0000000001160000-0x0000000001176000-memory.dmp

Filesize
88KB

Download
memory/3364-122-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3364-128-0x00000000005A0000-0x000000000073B000-memory.dmp

Filesize
1.6MB

Download
memory/3364-127-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3364-126-0x00000000009E0000-0x0000000000D00000-memory.dmp

Filesize
3.1MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads