xloader | 4860d96e25e9ffa5a288ee4ab81dbda67a521786b2abd2b7a91a3b37e863fe58

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
23/03/2022, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
STATEMENT OF ACCOUNT (2).exe
Size 867KB
Sample220323-mvj2faceg7
SHA256 4860d96e25e9ffa5a288ee4ab81dbda67a521786b2abd2b7a91a3b37e863fe58
MD5 289cbbecf6a93c1f75688b3ca14a8730
SHA1 2f99dab38f9c11889505c519492c9101d15eadf1
SHA512 0510024d17f82ca8eb677b0c4e624edecd2c6c152e73c50a99eea9a587988a26e5aaa25b1e6b89ef832c7f0d47524f93ae9925f6e620e0ea22016da512b7b258
MD5 SHA1 SHA512

Score

10^/10

xloader oogi loader persistence rat

Malware Config

Extracted

Family

xloader

Version

Campaign

oogi

Decoy

cminethings.com
hitsduo.com
cicisolutions.digital
nathancooley.com
nextvaccines.com
marciabernice.com
planmemberelite.com
gotage.com
danijela-djordjevic.com
joyases.com
hldxhzs.com
subngon47.com
kitships.com
duplicatedaves.com
mihmiz.com
sophisticatedsignings.com
vrarw.com
wxdfxx.com
schoolshopni.com
thegarageguys.store
jasonsmaintenance.com
naplesairportdrivers.com
paramuslawfirm.com
atawassol.com
cures8t.com
advanswa.com
proyectocajablanca.com
apresschi.com
gionakpil.com
pumpkincheshire.com
379531.com
xn--399a9jk03ai6p.com
tsfddtt.xyz
communityfoodie.com
threadrounds.com
kairos.coffee
balushibrand.com
cyzeboy5.xyz
syxinyu.com
deaoc.com
highcountrymortar.com
franefelipe.com
ubhantibots001.com
bergarallied.com
xcdy1818.com
socalsurvivalchick.com
premiumcontent.online
bestofsaltlakecity.net
securetravel.singles
heartscout-de.art
xn--trigendatynohjaus-8zb.com
lesben-sex.biz
iphone13mini.radio
importoperations.com
nhathuocdoanhdiem.com
xemaykhangthinh.com
leadcopyventures.com
pyzulin.com
titelvasem.quest
elguije.com
treeteeco.com
itserver-sh.com
khubconsortium.com
roadreputation.com
vifobox.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/3568-135-0x0000000000000000-mapping.dmp	xloader
behavioral2/memory/3568-137-0x0000000072480000-0x00000000724A9000-memory.dmp	xloader
behavioral2/memory/2040-157-0x00000000007A0000-0x00000000007C9000-memory.dmp	xloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
97	2040	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pdrlkrj = "C:\\Users\\Public\\jrklrdP.url"	STATEMENT OF ACCOUNT (2).exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3568 set thread context of 2180	3568	logagent.exe	24
PID 2040 set thread context of 2180	2040	msiexec.exe	24

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	STATEMENT OF ACCOUNT (2).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	STATEMENT OF ACCOUNT (2).exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
3568	logagent.exe
3568	logagent.exe
3568	logagent.exe
3568	logagent.exe
4492	powershell.exe
4492	powershell.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe
2040	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2180	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3568	logagent.exe
3568	logagent.exe
3568	logagent.exe
2040	msiexec.exe
2040	msiexec.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	3568	logagent.exe
Token: SeDebugPrivilege	4492	powershell.exe
Token: SeShutdownPrivilege	2180	Explorer.EXE
Token: SeCreatePagefilePrivilege	2180	Explorer.EXE
Token: SeDebugPrivilege	2040	msiexec.exe
Token: SeShutdownPrivilege	2180	Explorer.EXE
Token: SeCreatePagefilePrivilege	2180	Explorer.EXE
Token: SeShutdownPrivilege	2180	Explorer.EXE
Token: SeCreatePagefilePrivilege	2180	Explorer.EXE
Token: SeShutdownPrivilege	2180	Explorer.EXE
Token: SeCreatePagefilePrivilege	2180	Explorer.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 3568	3924	STATEMENT OF ACCOUNT (2).exe	91
PID 3924 wrote to memory of 3568	3924	STATEMENT OF ACCOUNT (2).exe	91
PID 3924 wrote to memory of 3568	3924	STATEMENT OF ACCOUNT (2).exe	91
PID 3924 wrote to memory of 3568	3924	STATEMENT OF ACCOUNT (2).exe	91
PID 3924 wrote to memory of 3568	3924	STATEMENT OF ACCOUNT (2).exe	91
PID 3924 wrote to memory of 3568	3924	STATEMENT OF ACCOUNT (2).exe	91
PID 3924 wrote to memory of 3776	3924	STATEMENT OF ACCOUNT (2).exe	92
PID 3924 wrote to memory of 3776	3924	STATEMENT OF ACCOUNT (2).exe	92
PID 3924 wrote to memory of 3776	3924	STATEMENT OF ACCOUNT (2).exe	92
PID 3776 wrote to memory of 3644	3776	cmd.exe	94
PID 3776 wrote to memory of 3644	3776	cmd.exe	94
PID 3776 wrote to memory of 3644	3776	cmd.exe	94
PID 3644 wrote to memory of 3876	3644	cmd.exe	96
PID 3644 wrote to memory of 3876	3644	cmd.exe	96
PID 3644 wrote to memory of 3876	3644	cmd.exe	96
PID 3876 wrote to memory of 1512	3876	net.exe	97
PID 3876 wrote to memory of 1512	3876	net.exe	97
PID 3876 wrote to memory of 1512	3876	net.exe	97
PID 3644 wrote to memory of 4492	3644	cmd.exe	98
PID 3644 wrote to memory of 4492	3644	cmd.exe	98
PID 3644 wrote to memory of 4492	3644	cmd.exe	98
PID 2180 wrote to memory of 2040	2180	Explorer.EXE	100
PID 2180 wrote to memory of 2040	2180	Explorer.EXE	100
PID 2180 wrote to memory of 2040	2180	Explorer.EXE	100

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT (2).exe
  "C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT (2).exe"
  2⤵
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\SysWOW64\logagent.exe
    C:\Windows\System32\logagent.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Pdrlkrjt.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Public\PdrlkrjO.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3644
    - - C:\Windows\SysWOW64\net.exe
        
        net session
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3876
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:1512
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4492
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-156-0x0000000000B90000-0x0000000000BA2000-memory.dmp

Download

memory/2040-157-0x00000000007A0000-0x00000000007C9000-memory.dmp

Download

memory/2040-158-0x00000000029A0000-0x0000000002CEA000-memory.dmp

Download

memory/2040-167-0x00000000026D0000-0x0000000002760000-memory.dmp

Download

memory/2180-148-0x00000000089C0000-0x0000000008AAF000-memory.dmp

Download

memory/2180-168-0x0000000008AB0000-0x0000000008BE0000-memory.dmp

Download

memory/3568-146-0x00000000030F0000-0x000000000343A000-memory.dmp

Download

memory/3568-147-0x0000000002FF0000-0x0000000003001000-memory.dmp

Download

memory/3568-137-0x0000000072480000-0x00000000724A9000-memory.dmp

Download

memory/4492-155-0x0000000005FB0000-0x0000000005FCE000-memory.dmp

Download

memory/4492-153-0x00000000059E0000-0x0000000005A46000-memory.dmp

Download

memory/4492-152-0x0000000005290000-0x00000000052F6000-memory.dmp

Download

memory/4492-151-0x00000000050F0000-0x0000000005112000-memory.dmp

Download

memory/4492-159-0x0000000002A75000-0x0000000002A77000-memory.dmp

Download

memory/4492-160-0x0000000006560000-0x0000000006592000-memory.dmp

Download

memory/4492-161-0x000000006FC20000-0x000000006FC6C000-memory.dmp

Download

memory/4492-162-0x0000000006520000-0x000000000653E000-memory.dmp

Download

memory/4492-163-0x0000000007950000-0x0000000007FCA000-memory.dmp

Download

memory/4492-164-0x00000000071D0000-0x00000000071EA000-memory.dmp

Download

memory/4492-165-0x0000000007310000-0x000000000731A000-memory.dmp

Download

memory/4492-166-0x0000000007500000-0x0000000007596000-memory.dmp

Download

memory/4492-150-0x00000000053B0000-0x00000000059D8000-memory.dmp

Download

memory/4492-149-0x0000000002AD0000-0x0000000002B06000-memory.dmp

Download

memory/4492-169-0x00000000074D0000-0x00000000074DE000-memory.dmp

Download

memory/4492-170-0x00000000075C0000-0x00000000075DA000-memory.dmp

Download

memory/4492-171-0x00000000075B0000-0x00000000075B8000-memory.dmp

Download