xloader | 90d258580952ea2255d7c14ea3778600d262ffdb5a05519b8899c09035e22aac

Analysis

max time kernel
159s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
24/03/2022, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FedEx Shipment doc.exe
Size 1.0MB
Sample220324-nclb8agcc7
SHA256 90d258580952ea2255d7c14ea3778600d262ffdb5a05519b8899c09035e22aac
MD5 28532e095c71f475ed8f0d0165313c1b
SHA1 b64083cb4cc84f997b9ae57637cc4957da893ba8
SHA512 0bd0c041f41e8b6a098c24a277cb75726b9ead7da16e8ad23a736f09eb5842f78436c5f364328c553d398aad769cccd28df06335c2ce0b067d601d8ad6fec20c
MD5 SHA1 SHA512

Score

10^/10

xloader qdq1 loader rat

Malware Config

Extracted

Family

xloader

Version

Campaign

qdq1

Decoy

advertising-machine.online
photo.fail
loyaltyfaq.com
7lywzx3mh.com
liberate2024.com
xn--xhqp74a1vhb74b.group
konekt-top.space
portraitsbypaul.com
cattlecoinranch.com
3963.space
egigpay.com
thesouthlandband.com
vickywestmore.com
rewindau.com
21countryplace.com
cuffingseasonfilm.com
variableclement.com
ericksonwebmail.com
lmczedu.com
brw-solutlons.com
ces-emprego.com
berdisen.com
stirrupforgnk.xyz
thepathtotreatment.com
trafficserv.com
circuitomedico.com
hyperion-eyewear.com
nagoyaenglish.com
kninetechnologies.com
mypimplepatch.com
communication.services
inventionmark.com
kompilotea.com
trx-forum.com
alishatours.com
cursosonlinebrs.com
opheliemartin.com
ciscoenterpriseit.com
jjwecommerce.com
99d375.xyz
joarclothing.com
trompeexternality.info
destopower.com
plexmediacenter.com
smikouy.store
lolevad.club
indianapolisnotarypublic.com
cchealthit.com
mimoseartesanatosatelie.com
corvx666.com
xaswy.com
cristina-yanbal.com
marina-selezneva.com
smartpinkpermit.xyz
metaversemonetization.com
zioholdings.com
asustoto.club
cmjworkshops.com
beriteautoglass.com
originalkodsukses.icu
bengchina.com
influencios.xyz
dressesfraweb.com
marqlabs.net
492721.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/912-136-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/1600-143-0x0000000000350000-0x0000000000379000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1740 set thread context of 912	1740	FedEx Shipment doc.exe	89
PID 912 set thread context of 2620	912	FedEx Shipment doc.exe	42
PID 1600 set thread context of 2620	1600	cmd.exe	42

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
912	FedEx Shipment doc.exe
912	FedEx Shipment doc.exe
912	FedEx Shipment doc.exe
912	FedEx Shipment doc.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe
1600	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2620	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
912	FedEx Shipment doc.exe
912	FedEx Shipment doc.exe
912	FedEx Shipment doc.exe
1600	cmd.exe
1600	cmd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	FedEx Shipment doc.exe
Token: SeDebugPrivilege	1600	cmd.exe
Token: SeShutdownPrivilege	2620	Explorer.EXE
Token: SeCreatePagefilePrivilege	2620	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 912	1740	FedEx Shipment doc.exe	89
PID 1740 wrote to memory of 912	1740	FedEx Shipment doc.exe	89
PID 1740 wrote to memory of 912	1740	FedEx Shipment doc.exe	89
PID 1740 wrote to memory of 912	1740	FedEx Shipment doc.exe	89
PID 1740 wrote to memory of 912	1740	FedEx Shipment doc.exe	89
PID 1740 wrote to memory of 912	1740	FedEx Shipment doc.exe	89
PID 2620 wrote to memory of 1600	2620	Explorer.EXE	90
PID 2620 wrote to memory of 1600	2620	Explorer.EXE	90
PID 2620 wrote to memory of 1600	2620	Explorer.EXE	90
PID 1600 wrote to memory of 1924	1600	cmd.exe	91
PID 1600 wrote to memory of 1924	1600	cmd.exe	91
PID 1600 wrote to memory of 1924	1600	cmd.exe	91

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Users\Admin\AppData\Local\Temp\FedEx Shipment doc.exe
  "C:\Users\Admin\AppData\Local\Temp\FedEx Shipment doc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Users\Admin\AppData\Local\Temp\FedEx Shipment doc.exe
    "C:\Users\Admin\AppData\Local\Temp\FedEx Shipment doc.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\FedEx Shipment doc.exe"
    3⤵
    PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-139-0x0000000000F20000-0x0000000000F31000-memory.dmp

Download

memory/912-137-0x0000000000F70000-0x00000000012BA000-memory.dmp

Download

memory/912-136-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1600-142-0x0000000000880000-0x00000000008DA000-memory.dmp

Download

memory/1600-143-0x0000000000350000-0x0000000000379000-memory.dmp

Download

memory/1600-145-0x0000000000FF0000-0x000000000133A000-memory.dmp

Download

memory/1600-146-0x0000000000EB0000-0x0000000000F40000-memory.dmp

Download

memory/1740-134-0x0000000009F40000-0x0000000009FDC000-memory.dmp

Download

memory/1740-133-0x0000000007930000-0x000000000793A000-memory.dmp

Download

memory/1740-132-0x00000000077A0000-0x0000000007832000-memory.dmp

Download

memory/1740-131-0x0000000007C70000-0x0000000008214000-memory.dmp

Download

memory/1740-130-0x0000000000820000-0x0000000000930000-memory.dmp

Download

memory/2620-140-0x00000000090C0000-0x0000000009228000-memory.dmp

Download

memory/2620-147-0x0000000004D30000-0x0000000004E1B000-memory.dmp

Download