xloader | e50a6adc3a4af45a5cfac4a213be964aa7ed0db5eb8b13ed7c4fc99e160cbc67

General

Target

PO930832084.exe
Size

341KB
MD5

370cdd4fca95e154659920f86124091b
SHA1

70fc058fe1dda4ed6b00da429e3849d11d1127f8
SHA256

00668e0dac77414a7a5fc8df4867e3a75fc928cdd97b57c068edb11522fecf97
SHA512

7d23b4ab99551a5b57d93d77953b9fa7702916c0cd6bbef263526d165a5dcd7825f17fba74797027ad456b3a7a3d35b1c066861fea583420389f984aadb831df

Score

10^/10

xloader b6fg loader rat

Malware Config

Extracted

Family

xloader

Version

2.0

Campaign

b6fg

Decoy

multlockmt5.com

mohajrannoor.com

robynhoodofretail.info

belinv.com

hotellasab.com

kibrismosad.com

xn--fxwm39aeb590h.xn--io0a7i

resetbrasil.com

tcsonhvac.com

theresav.net

bohoqi.info

machinafuturae.com

mambavault.com

xn--980am9a.top

yumiang.com

evntmonitor.com

83003kk.com

triterm.com

8800pe.com

silvanstudio.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/5104-132-0x0000000000400000-0x0000000000427000-memory.dmp	xloader
behavioral2/memory/5104-134-0x0000000000400000-0x0000000000427000-memory.dmp	xloader

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 2 IoCs

Processes:

PO930832084.exevbc.exe

description	pid	process	target process
PID 5020 set thread context of 5104	5020	PO930832084.exe	vbc.exe
PID 5104 set thread context of 2604	5104	vbc.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

PO930832084.exevbc.exe

pid process

5020 PO930832084.exe
5020 PO930832084.exe
5020 PO930832084.exe
5020 PO930832084.exe
5104 vbc.exe
5104 vbc.exe
5104 vbc.exe
5104 vbc.exe
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

vbc.exe

pid process

5104 vbc.exe
5104 vbc.exe
5104 vbc.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

PO930832084.exevbc.exe

description pid process

Token: SeDebugPrivilege 5020 PO930832084.exe
Token: SeDebugPrivilege 5104 vbc.exe

pid	process
5020	PO930832084.exe
5020	PO930832084.exe
5020	PO930832084.exe
5020	PO930832084.exe
5104	vbc.exe
5104	vbc.exe
5104	vbc.exe
5104	vbc.exe

pid	process
5104	vbc.exe
5104	vbc.exe
5104	vbc.exe

description	pid	process
Token: SeDebugPrivilege	5020	PO930832084.exe
Token: SeDebugPrivilege	5104	vbc.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

PO930832084.exeExplorer.EXE

description	pid	process	target process
PID 5020 wrote to memory of 1340	5020	PO930832084.exe	vbc.exe
PID 5020 wrote to memory of 1340	5020	PO930832084.exe	vbc.exe
PID 5020 wrote to memory of 1340	5020	PO930832084.exe	vbc.exe
PID 5020 wrote to memory of 2124	5020	PO930832084.exe	vbc.exe
PID 5020 wrote to memory of 2124	5020	PO930832084.exe	vbc.exe
PID 5020 wrote to memory of 2124	5020	PO930832084.exe	vbc.exe
PID 5020 wrote to memory of 5104	5020	PO930832084.exe	vbc.exe
PID 5020 wrote to memory of 5104	5020	PO930832084.exe	vbc.exe
PID 5020 wrote to memory of 5104	5020	PO930832084.exe	vbc.exe
PID 5020 wrote to memory of 5104	5020	PO930832084.exe	vbc.exe
PID 5020 wrote to memory of 5104	5020	PO930832084.exe	vbc.exe
PID 5020 wrote to memory of 5104	5020	PO930832084.exe	vbc.exe
PID 2604 wrote to memory of 4312	2604	Explorer.EXE	wscript.exe
PID 2604 wrote to memory of 4312	2604	Explorer.EXE	wscript.exe
PID 2604 wrote to memory of 4312	2604	Explorer.EXE	wscript.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:2604

C:\Users\Admin\AppData\Local\Temp\PO930832084.exe
"C:\Users\Admin\AppData\Local\Temp\PO930832084.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
3⤵
PID:1340

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
3⤵
PID:2124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5104

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\SysWOW64\wscript.exe"
2⤵
PID:4312

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1340-129-0x0000000000000000-mapping.dmp

Download
memory/2124-130-0x0000000000000000-mapping.dmp

Download
memory/2604-137-0x00000000028C0000-0x0000000002A20000-memory.dmp

Filesize
1.4MB

Download
memory/4312-138-0x0000000000000000-mapping.dmp

Download
memory/5020-127-0x00000000059C0000-0x00000000059CA000-memory.dmp

Filesize
40KB

Download
memory/5020-128-0x00000000017C0000-0x000000000185C000-memory.dmp

Filesize
624KB

Download
memory/5020-124-0x0000000000F20000-0x0000000000F7C000-memory.dmp

Filesize
368KB

Download
memory/5020-126-0x0000000005900000-0x0000000005992000-memory.dmp

Filesize
584KB

Download
memory/5020-125-0x0000000005E10000-0x00000000063B4000-memory.dmp

Filesize
5.6MB

Download
memory/5104-131-0x0000000000000000-mapping.dmp

Download
memory/5104-132-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/5104-134-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/5104-135-0x0000000001080000-0x00000000013CA000-memory.dmp

Filesize
3.3MB

Download
memory/5104-136-0x0000000000B00000-0x0000000000B10000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads