xloader | 9ed12486b8f2201f6e6783b44fb9fda3ca0866f746abe3269b8b9bb1edab45b2

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20220414-en
submitted
14/04/2022, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe
Size 966KB
Sample220414-yn9jasdfgp
SHA256 9ed12486b8f2201f6e6783b44fb9fda3ca0866f746abe3269b8b9bb1edab45b2
MD5 13204a58bf95ebaffad3a2f66d7e78bb
SHA1 f61d152fb3fbc81d3a1ee33f7646762e7cbe6c13
SHA512 3860eddf76219fa87092ad91b54834b63cec0278151a1494069fb74589180bdd34bc1183848a9544ef923a9c3d4ed9ed76ef121117bffd5777e32a224daa1fb1
MD5 SHA1 SHA512

Score

10^/10

xloader g6k0 loader rat suricata

Malware Config

Extracted

Family

xloader

Version

Campaign

g6k0

Decoy

tour-peru-machupicchu.com
hautebazaar.net
southking.tech
b148tlrnd09ustnnaku2721.com
finlandnine.xyz
nevalostrecords.com
yberwomanshowcase.com
fourfatcats.com
pa66sujiao.com
bodychile.com
vireoenvironmentalllc.com
williamhag.online
tsctribe.com
tenutoai.com
10thring.com
picturebookoriginals.com
discord-gif.xyz
benefitcarolina.com
stellarsweats.com
cr7tips.com
studioimplicita.com
aidenb.tech
homeremodelingleads.com
ocvcoins.com
donwalin.com
fogijjipv.xyz
miniblueheelers.com
tunnelvisionconference.com
lumilentmed.com
icicareers.com
pretog.com
skinmedic.club
petswastepickup.com
hombreobjeto.com
scwrdctyewfrcdqu.cloud
holdvfind.store
changeswissmind.com
sitejdfinancas.club
shipmandesignz.com
youcanstores.com
pagchapman.top
p8x.claims
usps-postal-us.com
goldenn.store
makonigroup.com
musicafe.tech
thepanopticgroup.com
revivesurgicals.xyz
freakyhamsters.com
sharpberth.com
alibiaglet.pro
yfguolu.com
lem-headspa.com
priorityvvorkforces.com
tra4fficsearchtabspace.rest
levelfivequaning.com
86braith.com
zhuangmengmeng.com
bizzyagency.com
hemperek.net
terrierslovjt.xyz
kompor-premium.online
bajajfinservmutualfunds.com
schonheitschirurg.online
cannonbrookes.online

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1376-61-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1376-62-0x000000000041D500-mapping.dmp	xloader
behavioral1/memory/1816-71-0x00000000000D0000-0x00000000000F9000-memory.dmp	xloader

Deletes itself 1 IoCs

pid	Process
1184	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1852 set thread context of 1376	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	31
PID 1376 set thread context of 1384	1376	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	19
PID 1816 set thread context of 1384	1816	msiexec.exe	19

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe
1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe
1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe
1376	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe
1376	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe
1816	msiexec.exe
1816	msiexec.exe
1816	msiexec.exe
1816	msiexec.exe
1816	msiexec.exe
1816	msiexec.exe
1816	msiexec.exe
1816	msiexec.exe
1816	msiexec.exe
1816	msiexec.exe
1816	msiexec.exe
1816	msiexec.exe
1816	msiexec.exe
1816	msiexec.exe
1816	msiexec.exe
1816	msiexec.exe
1816	msiexec.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1376	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe
1376	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe
1376	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe
1816	msiexec.exe
1816	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe
Token: SeDebugPrivilege	1376	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe
Token: SeDebugPrivilege	1816	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1384	Explorer.EXE
1384	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1384	Explorer.EXE
1384	Explorer.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1308	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	28
PID 1852 wrote to memory of 1308	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	28
PID 1852 wrote to memory of 1308	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	28
PID 1852 wrote to memory of 1308	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	28
PID 1852 wrote to memory of 1324	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	30
PID 1852 wrote to memory of 1324	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	30
PID 1852 wrote to memory of 1324	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	30
PID 1852 wrote to memory of 1324	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	30
PID 1852 wrote to memory of 1456	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	29
PID 1852 wrote to memory of 1456	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	29
PID 1852 wrote to memory of 1456	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	29
PID 1852 wrote to memory of 1456	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	29
PID 1852 wrote to memory of 1376	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	31
PID 1852 wrote to memory of 1376	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	31
PID 1852 wrote to memory of 1376	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	31
PID 1852 wrote to memory of 1376	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	31
PID 1852 wrote to memory of 1376	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	31
PID 1852 wrote to memory of 1376	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	31
PID 1852 wrote to memory of 1376	1852	Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe	31
PID 1384 wrote to memory of 1816	1384	Explorer.EXE	32
PID 1384 wrote to memory of 1816	1384	Explorer.EXE	32
PID 1384 wrote to memory of 1816	1384	Explorer.EXE	32
PID 1384 wrote to memory of 1816	1384	Explorer.EXE	32
PID 1384 wrote to memory of 1816	1384	Explorer.EXE	32
PID 1384 wrote to memory of 1816	1384	Explorer.EXE	32
PID 1384 wrote to memory of 1816	1384	Explorer.EXE	32
PID 1816 wrote to memory of 1184	1816	msiexec.exe	33
PID 1816 wrote to memory of 1184	1816	msiexec.exe	33
PID 1816 wrote to memory of 1184	1816	msiexec.exe	33
PID 1816 wrote to memory of 1184	1816	msiexec.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Local\Temp\Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe
  "C:\Users\Admin\AppData\Local\Temp\Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Users\Admin\AppData\Local\Temp\Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe
    "C:\Users\Admin\AppData\Local\Temp\Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe"
    3⤵
    PID:1308
- - C:\Users\Admin\AppData\Local\Temp\Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe
    "C:\Users\Admin\AppData\Local\Temp\Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe"
    3⤵
    PID:1456
- - C:\Users\Admin\AppData\Local\Temp\Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe
    "C:\Users\Admin\AppData\Local\Temp\Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe"
    3⤵
    PID:1324
- - C:\Users\Admin\AppData\Local\Temp\Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe
    "C:\Users\Admin\AppData\Local\Temp\Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:1376
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Angebot RESALE DE Maschinen Interesse Nummer 000776244132145.exe"
    3⤵
    - Deletes itself
    PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-63-0x0000000000B20000-0x0000000000E23000-memory.dmp

Download

memory/1376-65-0x0000000000240000-0x0000000000251000-memory.dmp

Download

memory/1376-58-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1376-59-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1376-61-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1384-74-0x0000000004150000-0x00000000041FF000-memory.dmp

Download

memory/1384-66-0x0000000003B70000-0x0000000003C3F000-memory.dmp

Download

memory/1816-68-0x00000000753B1000-0x00000000753B3000-memory.dmp

Download

memory/1816-70-0x00000000009D0000-0x00000000009E4000-memory.dmp

Download

memory/1816-71-0x00000000000D0000-0x00000000000F9000-memory.dmp

Download

memory/1816-72-0x00000000021C0000-0x00000000024C3000-memory.dmp

Download

memory/1816-73-0x0000000001FF0000-0x0000000002080000-memory.dmp

Download

memory/1852-56-0x0000000005ED0000-0x0000000005F84000-memory.dmp

Download

memory/1852-54-0x0000000000120000-0x0000000000216000-memory.dmp

Download

memory/1852-55-0x0000000000520000-0x000000000052E000-memory.dmp

Download

memory/1852-57-0x0000000005F80000-0x0000000005FF2000-memory.dmp

Download