xloader | 71da5f67c97d46f0a0a6b6fccb0629690ff520c23e54e6c67b17f35c97cbf09b

General

Target
Invoice.exe
Size 840KB
Sample220409-j69jpaffe5
SHA256 71da5f67c97d46f0a0a6b6fccb0629690ff520c23e54e6c67b17f35c97cbf09b
MD5 ebab60dab6e1229ce726bba5db5f5f27
SHA1 0f820f47a6dd6c6950b125f8ac85093b8c7229d7
SHA512 bc5ba6bfd594bb683ddd4b5a90f60e197c2f786b8e65775243eca0f18050a7a51d2c58c3a93e69dcca66b92878e4f3a40c87cd68bc196136a1a5574a60497051
MD5 SHA1 SHA512

Score

10^/10

xloader 3e9r loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

3e9r

Decoy

143411.com
300dh.xyz
win-chance.info
essentialsofbeauty.com
skategrindingwheels.com
jyqtgg.com
exodijuis.com
goodwinpuppies.com
doitlive.online
hello-orchid.com
shangjibbs.com
innovarecic.com
fococomunicacaovisuales.com
completemarine.care
parodistluxuryroll.com
anda568.com
unicorm.digital
weaveapp.xyz
artractions.com
app-ads-network.com
okbruv.com
erickdechavez.com
massanyakudachiblog.com
easywhiff.com
biurowe.online
rapibest.com
kfovideo.xyz
bobswoodchip.com
otcnetsys.com
empiredigitalcbdstore.com
securityfirstlt.com
oracigypten.quest
nerohub.com
kartupokerjp889.com
amarbakers.online
hopeballoonfestival.com
pgzaandam.online
pauschalreisen.xyz
topindiahistory.xyz
polkadotskull.com
hdmseotools.com
sampatrickpage.com
document908070392.host
anthonywvea.com
drogueriaaprial.com
iphone13mini.computer
wbgdglobal.com
hyponymys.info
vagusartesaniaymoda.online
gqsmg.com
fandenacqua.quest
lace-underwear.store
xpressporn.com
hotelposadanova.com
rapidcae.com
iuckychance.com
hathumbglobal.com
drone-rullime.com
upgown.com
kvistuv.quest
rogersthemusical.com
likesub247.info
bhadrakalisandhya.com
suddennnnnnnnnnnn03.xyz
divinehuntbegins.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/1972-63-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1972-64-0x000000000041D440-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1548 set thread context of 1972	1548	Invoice.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	1972	WerFault.exe	30

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2024	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1548	Invoice.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2024	1548	Invoice.exe	28
PID 1548 wrote to memory of 2024	1548	Invoice.exe	28
PID 1548 wrote to memory of 2024	1548	Invoice.exe	28
PID 1548 wrote to memory of 2024	1548	Invoice.exe	28
PID 1548 wrote to memory of 1972	1548	Invoice.exe	30
PID 1548 wrote to memory of 1972	1548	Invoice.exe	30
PID 1548 wrote to memory of 1972	1548	Invoice.exe	30
PID 1548 wrote to memory of 1972	1548	Invoice.exe	30
PID 1548 wrote to memory of 1972	1548	Invoice.exe	30
PID 1548 wrote to memory of 1972	1548	Invoice.exe	30
PID 1548 wrote to memory of 1972	1548	Invoice.exe	30
PID 1548 wrote to memory of 1972	1548	Invoice.exe	30
PID 1548 wrote to memory of 1972	1548	Invoice.exe	30
PID 1548 wrote to memory of 1972	1548	Invoice.exe	30
PID 1972 wrote to memory of 1992	1972	RegSvcs.exe	31
PID 1972 wrote to memory of 1992	1972	RegSvcs.exe	31
PID 1972 wrote to memory of 1992	1972	RegSvcs.exe	31
PID 1972 wrote to memory of 1992	1972	RegSvcs.exe	31

C:\Users\Admin\AppData\Local\Temp\Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\edsSFcWsbwBV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5E47.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2024
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 36
    3⤵
    - Program crash
    PID:1992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp5E47.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5E47.tmp
Size 1KB
SHA256 e1f651da5d959a46e58ae09865af970622040e104d408e1a60fac0840847ecea
MD5 7936dee9f700db712a12cec9376b7cc8
SHA1 1d7dfa8456ab186e2e27a10abf232e5ced7072d0
SHA512 8533314b72c0c0e3ab04e2addc5e9ff57a3be8421f4a9fbc6e44015e5d9c85a99f76e4a062630d2c4a3a19cacc7539da6ee98bf0f7fa55eeed46e8c429567a1c
MD5 SHA1 SHA512

Submit Download

memory/1548-54-0x00000000000D0000-0x00000000001A8000-memory.dmp

Download

memory/1548-55-0x0000000000300000-0x000000000030A000-memory.dmp

Download

memory/1548-56-0x00000000055A0000-0x0000000005660000-memory.dmp

Download

memory/1548-57-0x0000000000700000-0x0000000000770000-memory.dmp

Download

memory/1972-60-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1972-61-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1972-63-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads