xloader | 145f840479b9baa3431886abf20b30820f2cc5fe427c0d14390818c7e38ad3cd

General

Target

145f840479b9baa3431886abf20b30820f2cc5fe427c0d14390818c7e38ad3cd.exe
Size

274KB
MD5

16c4a16f7bd751b068e65d81ba2f64cd
SHA1

3cc2679cb6af197f177481f7708bed0eed93f458
SHA256

145f840479b9baa3431886abf20b30820f2cc5fe427c0d14390818c7e38ad3cd
SHA512

8675970aa4fc84e3fc6e9b84b7189e8077a372e15b01be22bfd52877e2e6c94d439e213271d2554f242182fc9052b9b98148876e31096467c778cc508cad006f

Score

10^/10

xloader ahc8 loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ahc8

Decoy

192451.com

wwwripostes.net

sirikhalsalaw.com

bitterbaybay.com

stella-scrubs.com

almanecermezcal.com

goodgood.online

translate-now.online

sincerefilm.com

quadrantforensics.com

johnfrenchart.com

plick-click.com

alnileen.com

tghi.xyz

172711.com

maymakita.com

punnyaseva.com

ukash-online.com

sho-yururi-blog.com

hebergement-solidaire.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3656-134-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/3656-137-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/3580-142-0x00000000008E0000-0x0000000000909000-memory.dmp	xloader

Executes dropped EXE 2 IoCs

Processes:

hsssany.exehsssany.exe

pid process

3096 hsssany.exe
3656 hsssany.exe

pid	process
3096	hsssany.exe
3656	hsssany.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

hsssany.exehsssany.execmmon32.exe

description	pid	process	target process
PID 3096 set thread context of 3656	3096	hsssany.exe	hsssany.exe
PID 3656 set thread context of 2232	3656	hsssany.exe	Explorer.EXE
PID 3580 set thread context of 2232	3580	cmmon32.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

hsssany.execmmon32.exe

pid	process
3656	hsssany.exe
3656	hsssany.exe
3656	hsssany.exe
3656	hsssany.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe
3580	cmmon32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2232 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

hsssany.execmmon32.exe

pid process

3656 hsssany.exe
3656 hsssany.exe
3656 hsssany.exe
3580 cmmon32.exe
3580 cmmon32.exe

pid	process
2232	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

hsssany.execmmon32.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	3656	hsssany.exe
Token: SeDebugPrivilege	3580	cmmon32.exe
Token: SeShutdownPrivilege	2232	Explorer.EXE
Token: SeCreatePagefilePrivilege	2232	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

145f840479b9baa3431886abf20b30820f2cc5fe427c0d14390818c7e38ad3cd.exehsssany.exeExplorer.EXEcmmon32.exe

description	pid	process	target process
PID 3088 wrote to memory of 3096	3088	145f840479b9baa3431886abf20b30820f2cc5fe427c0d14390818c7e38ad3cd.exe	hsssany.exe
PID 3088 wrote to memory of 3096	3088	145f840479b9baa3431886abf20b30820f2cc5fe427c0d14390818c7e38ad3cd.exe	hsssany.exe
PID 3088 wrote to memory of 3096	3088	145f840479b9baa3431886abf20b30820f2cc5fe427c0d14390818c7e38ad3cd.exe	hsssany.exe
PID 3096 wrote to memory of 3656	3096	hsssany.exe	hsssany.exe
PID 3096 wrote to memory of 3656	3096	hsssany.exe	hsssany.exe
PID 3096 wrote to memory of 3656	3096	hsssany.exe	hsssany.exe
PID 3096 wrote to memory of 3656	3096	hsssany.exe	hsssany.exe
PID 3096 wrote to memory of 3656	3096	hsssany.exe	hsssany.exe
PID 3096 wrote to memory of 3656	3096	hsssany.exe	hsssany.exe
PID 2232 wrote to memory of 3580	2232	Explorer.EXE	cmmon32.exe
PID 2232 wrote to memory of 3580	2232	Explorer.EXE	cmmon32.exe
PID 2232 wrote to memory of 3580	2232	Explorer.EXE	cmmon32.exe
PID 3580 wrote to memory of 3912	3580	cmmon32.exe	cmd.exe
PID 3580 wrote to memory of 3912	3580	cmmon32.exe	cmd.exe
PID 3580 wrote to memory of 3912	3580	cmmon32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232

C:\Users\Admin\AppData\Local\Temp\145f840479b9baa3431886abf20b30820f2cc5fe427c0d14390818c7e38ad3cd.exe
"C:\Users\Admin\AppData\Local\Temp\145f840479b9baa3431886abf20b30820f2cc5fe427c0d14390818c7e38ad3cd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3088

C:\Users\Admin\AppData\Local\Temp\hsssany.exe
C:\Users\Admin\AppData\Local\Temp\hsssany.exe C:\Users\Admin\AppData\Local\Temp\igjxkq
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3096

C:\Users\Admin\AppData\Local\Temp\hsssany.exe
C:\Users\Admin\AppData\Local\Temp\hsssany.exe C:\Users\Admin\AppData\Local\Temp\igjxkq
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3580

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\hsssany.exe"
3⤵
PID:3912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fki5xdwbhcbhpy
MD5
7fb21510f14fd999145c37cb54d191de

SHA1
7ce318c80c798dfcc6a601d531f49ed95134e9ce

SHA256
a20f4cce92d9bd4eb9c9e943514de908ea2ca9f666623c04de319dd7a7a67367

SHA512
483b8cbab3e6bd316b290a7cc8f9ae5316d5f8d843e37a26ec628172a038454c557569729eb5cf1ca7731c8781580109a0c9c0f7d2a4c12012d716e2aa0d8e7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsssany.exe
MD5
a25a388c0f8ab3779421f0747163c39b

SHA1
22267c3ea32c9ff6077cc8eccab8e9704a8cd3f2

SHA256
f13565cdb210b49835f19fea5c535ae953c9e8a26ed7702b2fdf613a2c3e5959

SHA512
807bffd3a312cac816f7dea888af7918c639ebaec25f2afb0f8afdb408ca4ffe06feead3e745bc46c8ca5a4e0ccb5f279ebe7a19c768ddcc839505b26a28ead2

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsssany.exe
MD5
a25a388c0f8ab3779421f0747163c39b

SHA1
22267c3ea32c9ff6077cc8eccab8e9704a8cd3f2

SHA256
f13565cdb210b49835f19fea5c535ae953c9e8a26ed7702b2fdf613a2c3e5959

SHA512
807bffd3a312cac816f7dea888af7918c639ebaec25f2afb0f8afdb408ca4ffe06feead3e745bc46c8ca5a4e0ccb5f279ebe7a19c768ddcc839505b26a28ead2

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsssany.exe
MD5
a25a388c0f8ab3779421f0747163c39b

SHA1
22267c3ea32c9ff6077cc8eccab8e9704a8cd3f2

SHA256
f13565cdb210b49835f19fea5c535ae953c9e8a26ed7702b2fdf613a2c3e5959

SHA512
807bffd3a312cac816f7dea888af7918c639ebaec25f2afb0f8afdb408ca4ffe06feead3e745bc46c8ca5a4e0ccb5f279ebe7a19c768ddcc839505b26a28ead2

Download Submit
C:\Users\Admin\AppData\Local\Temp\igjxkq
MD5
1169886f2881955b7e4af98a4d4251d6

SHA1
ab0a023754e13727d7e76c7821da43667519c1aa

SHA256
f0c6b182474ca01313269fb8f3a1e8aa82c2389ae1b0ee919ff710a34519f320

SHA512
80a7794c370cee1babd3dde9e412cfdc4ab850a1654623e3a4fe5657e7ab88d4ae77efcbd15fa9560d405ff01a422a41d9e6569a508a9f8a8987c36fc479f314

Download Submit
memory/2232-140-0x0000000008210000-0x00000000082C1000-memory.dmp

Filesize
708KB

Download
memory/2232-145-0x0000000002AD0000-0x0000000002BAD000-memory.dmp

Filesize
884KB

Download
memory/3580-141-0x0000000000420000-0x000000000042C000-memory.dmp

Filesize
48KB

Download
memory/3580-142-0x00000000008E0000-0x0000000000909000-memory.dmp

Filesize
164KB

Download
memory/3580-143-0x00000000028A0000-0x0000000002BEA000-memory.dmp

Filesize
3.3MB

Download
memory/3580-144-0x0000000002600000-0x0000000002690000-memory.dmp

Filesize
576KB

Download
memory/3656-137-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3656-138-0x0000000000A30000-0x0000000000D7A000-memory.dmp

Filesize
3.3MB

Download
memory/3656-139-0x00000000009D0000-0x00000000009E1000-memory.dmp

Filesize
68KB

Download
memory/3656-134-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads