xloader | 7a975e0983903a474303dfbab00a6ccd3a5f9f3339fb1d756aa36f5172361e7c

Analysis

max time kernel
160s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
28/03/2022, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
280322028656,pdf.exe
Size 1.2MB
Sample220328-p5ssfaeahn
SHA256 7a975e0983903a474303dfbab00a6ccd3a5f9f3339fb1d756aa36f5172361e7c
MD5 e7ed517edb255b2b0b90165552d7f12d
SHA1 8fefb192e7b649e7851bc6dfc9bb98cf080e939d
SHA512 df798917c327137544c7f2039d52a72b40b791d5e93ddcd9e24cf5ea0458d048798d3992bb6b16a2fb38ad94164425cc40e5eea25b00d02e3e7c33737d70754d
MD5 SHA1 SHA512

Score

10^/10

xloader p8mc evasion loader rat suricata

Malware Config

Extracted

Family

xloader

Version

Campaign

p8mc

Decoy

zdravotni-predpis.com
bjzsdh.com
statkey.solutions
yunshuoedu.com
segafredo-eg.com
thakurtohgayo.com
ndhpxw.net
airpr0ducts.com
adafxpress.com
pizzawalasindia.com
app-sec.pro
badminton-grip.com
17plazamiami.com
helpigservices.com
578983.com
lunchwithhilary.com
mainstreetpineville.com
emgmcamali.net
glanxoka.com
megntechsolutions.com
unnodash.com
seven27media-affiliate.com
testersclothing.com
sky-musical.com
dualipadenver.com
jettenerchi.com
moneypositivity.coach
levitate-studios.com
rebuildgomnmf.xyz
sqwiinlqjcv.mobi
arbinodes.art
crystallbrightserum.store
xn--mobile-bar-mnchen-e3b.com
esdomain48.xyz
ssojunghan.com
cubares6.com
jumbino.com
asktosantoshsahani.com
boluescortbayanim.xyz
stablebot.tech
resonators-and.com
krekuventures.com
18265k.com
villano8.com
qhdht.net
relief-en-goverment-service.com
impiantidentalibuscaritaorg.com
onlinedatingthainet.com
marib-antiquities.com
healthcarerevamped.com
sevillafinal2022.com
ur-soul.com
moderna-agency.com
txsjq.com
alnaturastiftung.net
tappsis.land
variante-udni.com
divipulse.com
munakatakouzousekkei.com
tradeshowgear.com
lyndonexcita.quest
nice2petfranchise.com
indousmedicalscribing.com
moderndoghouse.com
deviner.art

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/1712-140-0x0000000000400000-0x000000000043A000-memory.dmp	xloader
behavioral2/memory/1712-142-0x0000000000400000-0x000000000043A000-memory.dmp	xloader
behavioral2/memory/4360-148-0x0000000000DC0000-0x0000000000DE9000-memory.dmp	xloader

Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	280322028656,pdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	280322028656,pdf.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	280322028656,pdf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	280322028656,pdf.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5060 set thread context of 1712	5060	280322028656,pdf.exe	87
PID 1712 set thread context of 2996	1712	mshta.exe	52
PID 4360 set thread context of 2996	4360	cmd.exe	52

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5060	280322028656,pdf.exe
5060	280322028656,pdf.exe
5060	280322028656,pdf.exe
5060	280322028656,pdf.exe
5060	280322028656,pdf.exe
5060	280322028656,pdf.exe
5060	280322028656,pdf.exe
5060	280322028656,pdf.exe
5060	280322028656,pdf.exe
5060	280322028656,pdf.exe
1712	mshta.exe
1712	mshta.exe
1712	mshta.exe
1712	mshta.exe
5060	280322028656,pdf.exe
5060	280322028656,pdf.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe
4360	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2996	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1712	mshta.exe
1712	mshta.exe
1712	mshta.exe
4360	cmd.exe
4360	cmd.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	5060	280322028656,pdf.exe
Token: SeDebugPrivilege	1712	mshta.exe
Token: SeDebugPrivilege	4360	cmd.exe
Token: SeShutdownPrivilege	2996	Explorer.EXE
Token: SeCreatePagefilePrivilege	2996	Explorer.EXE
Token: SeShutdownPrivilege	2996	Explorer.EXE
Token: SeCreatePagefilePrivilege	2996	Explorer.EXE
Token: SeShutdownPrivilege	2996	Explorer.EXE
Token: SeCreatePagefilePrivilege	2996	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2996	Explorer.EXE
2996	Explorer.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 3380	5060	280322028656,pdf.exe	86
PID 5060 wrote to memory of 3380	5060	280322028656,pdf.exe	86
PID 5060 wrote to memory of 3380	5060	280322028656,pdf.exe	86
PID 5060 wrote to memory of 1712	5060	280322028656,pdf.exe	87
PID 5060 wrote to memory of 1712	5060	280322028656,pdf.exe	87
PID 5060 wrote to memory of 1712	5060	280322028656,pdf.exe	87
PID 5060 wrote to memory of 1712	5060	280322028656,pdf.exe	87
PID 5060 wrote to memory of 1712	5060	280322028656,pdf.exe	87
PID 5060 wrote to memory of 1712	5060	280322028656,pdf.exe	87
PID 5060 wrote to memory of 1712	5060	280322028656,pdf.exe	87
PID 2996 wrote to memory of 4360	2996	Explorer.EXE	89
PID 2996 wrote to memory of 4360	2996	Explorer.EXE	89
PID 2996 wrote to memory of 4360	2996	Explorer.EXE	89
PID 4360 wrote to memory of 2416	4360	cmd.exe	91
PID 4360 wrote to memory of 2416	4360	cmd.exe	91
PID 4360 wrote to memory of 2416	4360	cmd.exe	91

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Users\Admin\AppData\Local\Temp\280322028656,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\280322028656,pdf.exe"
  2⤵
  - Checks BIOS information in registry
  - Maps connected drives based on registry
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\SearchIndexer.exe
    "C:\Windows\SysWOW64\SearchIndexer.exe"
    3⤵
    PID:3380
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\SysWOW64\cmd.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\SysWOW64\mshta.exe"
    3⤵
    PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:2304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1712-143-0x00000000010A0000-0x00000000013EA000-memory.dmp

Download

memory/1712-144-0x0000000000C00000-0x0000000000C11000-memory.dmp

Download

memory/1712-140-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1712-142-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/2996-152-0x0000000008230000-0x0000000008346000-memory.dmp

Download

memory/2996-145-0x00000000083E0000-0x0000000008543000-memory.dmp

Download

memory/4360-148-0x0000000000DC0000-0x0000000000DE9000-memory.dmp

Download

memory/4360-147-0x0000000000980000-0x00000000009DA000-memory.dmp

Download

memory/4360-150-0x0000000001A00000-0x0000000001D4A000-memory.dmp

Download

memory/4360-151-0x0000000001820000-0x00000000018B0000-memory.dmp

Download

memory/5060-134-0x0000000000560000-0x0000000000694000-memory.dmp

Download

memory/5060-137-0x00000000065F0000-0x0000000006656000-memory.dmp

Download

memory/5060-136-0x0000000006A90000-0x0000000007034000-memory.dmp

Download

memory/5060-135-0x0000000005050000-0x00000000050EC000-memory.dmp

Download