xloader | 032dfad6230e8c5eb84d6225d3766cc849ae5b920fb62b2f24cb33896d94d465

Analysis

max time kernel
146s
max time network
149s
platform
windows7_x64
resource
win7-20220414-en
submitted
02/05/2022, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96afca76795a349365f562c265220068.exe
Size 425KB
Sample220502-hemeeahfdn
SHA256 032dfad6230e8c5eb84d6225d3766cc849ae5b920fb62b2f24cb33896d94d465
MD5 96afca76795a349365f562c265220068
SHA1 a37fa0252d6cadd31c73bbdc2be7ddc027f7a2bd
SHA512 75db0878f41f8e86b7476ee972e89b0dfdf97cbe0e562f7c7f2b81a24a01716bab4a06cfdb536cbc9782f5daf01eae8d3d158edf276dd1d7951e879abfae11a3
MD5 SHA1 SHA512

Score

10^/10

xloader s2q8 loader rat suricata

Malware Config

Extracted

Family

xloader

Version

Campaign

s2q8

Decoy

zenithcrushers.net
jeffreysfranchise.store
unavidaparaserfeliz.com
notvaccinatedjobs.com
jisakuzushi.com
demeet.xyz
immersioneconme.online
powercable.xyz
mingwwww.store
analystaide.com
ajfotografie.com
mothersmilktn.com
judithlisachomes.com
simplythaliachicago.com
goetzerehnstiftung.net
nowsportslive.online
hallowseason.com
triple16.com
grupomalucelli.com
fdtwr.com
walkrooms.com
brillianthold.com
fighttofly.net
cyberaised.online
moix.xyz
polny-privod.store
alieneyeline.com
stemgen.institute
m-i-consulting.com
mushrelief.com
programadoranoah.space
realtalkwithnikkinicole.com
sarkariresultjunction.com
ashiana-housing.com
forsecsolutions.com
areahomes-changedbysupport.com
trom.pro
iida.club
futuroverdepi.com
hxqp05.com
brighteningyourskin.com
adcrypto.xyz
europeflyscreen.com
nhanhthe.com
chinabsvl.com
nousky.com
epoksihediyelikler.com
arrowelectronics-corps.net
dewapokerasia.net
onzep.net
sanguo.football
iustingalea.com
sawarita.com
myimg.cloud
mentication.com
letrascorporeas.pro
bibercim.com
mountrredit.space
radyantpanel.com
antejeliciccoaching.com
fzld.xyz
piquinmarketing.com
fieldingsoundworks.com
dcsmj.com
shopdealzen.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/988-64-0x000000000041DA70-mapping.dmp	xloader
behavioral1/memory/988-63-0x0000000000400000-0x000000000042A000-memory.dmp	xloader
behavioral1/memory/988-67-0x0000000000400000-0x000000000042A000-memory.dmp	xloader
behavioral1/memory/2004-74-0x0000000000070000-0x000000000009A000-memory.dmp	xloader

Executes dropped EXE 2 IoCs

pid	Process
1760	cpjkhm.exe
988	cpjkhm.exe

Loads dropped DLL 2 IoCs

pid	Process
1376	96afca76795a349365f562c265220068.exe
1760	cpjkhm.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1760 set thread context of 988	1760	cpjkhm.exe	29
PID 988 set thread context of 1200	988	cpjkhm.exe	12
PID 2004 set thread context of 1200	2004	wscript.exe	12

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
988	cpjkhm.exe
988	cpjkhm.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe
2004	wscript.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
988	cpjkhm.exe
988	cpjkhm.exe
988	cpjkhm.exe
2004	wscript.exe
2004	wscript.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	988	cpjkhm.exe
Token: SeDebugPrivilege	2004	wscript.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1200	Explorer.EXE
1200	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1200	Explorer.EXE
1200	Explorer.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 1760	1376	96afca76795a349365f562c265220068.exe	28
PID 1376 wrote to memory of 1760	1376	96afca76795a349365f562c265220068.exe	28
PID 1376 wrote to memory of 1760	1376	96afca76795a349365f562c265220068.exe	28
PID 1376 wrote to memory of 1760	1376	96afca76795a349365f562c265220068.exe	28
PID 1760 wrote to memory of 988	1760	cpjkhm.exe	29
PID 1760 wrote to memory of 988	1760	cpjkhm.exe	29
PID 1760 wrote to memory of 988	1760	cpjkhm.exe	29
PID 1760 wrote to memory of 988	1760	cpjkhm.exe	29
PID 1760 wrote to memory of 988	1760	cpjkhm.exe	29
PID 1760 wrote to memory of 988	1760	cpjkhm.exe	29
PID 1760 wrote to memory of 988	1760	cpjkhm.exe	29
PID 1200 wrote to memory of 2004	1200	Explorer.EXE	30
PID 1200 wrote to memory of 2004	1200	Explorer.EXE	30
PID 1200 wrote to memory of 2004	1200	Explorer.EXE	30
PID 1200 wrote to memory of 2004	1200	Explorer.EXE	30
PID 2004 wrote to memory of 1692	2004	wscript.exe	31
PID 2004 wrote to memory of 1692	2004	wscript.exe	31
PID 2004 wrote to memory of 1692	2004	wscript.exe	31
PID 2004 wrote to memory of 1692	2004	wscript.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\96afca76795a349365f562c265220068.exe
  "C:\Users\Admin\AppData\Local\Temp\96afca76795a349365f562c265220068.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Users\Admin\AppData\Local\Temp\cpjkhm.exe
    C:\Users\Admin\AppData\Local\Temp\cpjkhm.exe C:\Users\Admin\AppData\Local\Temp\rsrpwoa
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\cpjkhm.exe
      C:\Users\Admin\AppData\Local\Temp\cpjkhm.exe C:\Users\Admin\AppData\Local\Temp\rsrpwoa
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:988
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\SysWOW64\wscript.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\cpjkhm.exe"
    3⤵
    PID:1692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

43tamsc4ul0czb3zcwio

Path C:\Users\Admin\AppData\Local\Temp\43tamsc4ul0czb3zcwio
Size 164KB
SHA256 2b20bdb5ba885f7048423ba5101a8ba25572edc83b47bf9a91e4759289e7203e
MD5 443aa56a81564e582bd77f49e097ec1d
SHA1 499b8d829bd4039cdbcfbc460721a960dddbc331
SHA512 9006d9f9924e40f3750e7c57fb5b877608ea8e64604430052fa0c996de15bf290b7425a317d93d95e66a2bd4e8f00561620d8eaffca04e2400010e25f2e773c8
SSDEEP 3072:G4wyj7N01nj0iphAvQmALGA3jeUXPfIuzt3Q+LkJC3cAUzFFeKx+kqEgcaQ1:m8JGj0Kh3XiA3FXHIet3Q+ZsfGKNrv
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpjkhm.exe

Path C:\Users\Admin\AppData\Local\Temp\cpjkhm.exe
Size 4KB
SHA256 4921031a6f9c7d20fe0a849eee9f16d792733fd34f32b346ac43098421093c43
MD5 c910a97bac72a537aa24144427c69290
SHA1 98382514ee34de89bdf8da5e0c136c5d0cb4097a
SHA512 2440c8fa743ba50b3ed973fb514e5a636a0aad82fafa48415e840df18f44d6553d450edad7cb417623288b883ea6316fbe40a567bc7e3ca85035b9b03740bc1d
MD5 SHA1 SHA512

Submit Download

cpjkhm.exe

Path C:\Users\Admin\AppData\Local\Temp\cpjkhm.exe
Size 4KB
SHA256 4921031a6f9c7d20fe0a849eee9f16d792733fd34f32b346ac43098421093c43
MD5 c910a97bac72a537aa24144427c69290
SHA1 98382514ee34de89bdf8da5e0c136c5d0cb4097a
SHA512 2440c8fa743ba50b3ed973fb514e5a636a0aad82fafa48415e840df18f44d6553d450edad7cb417623288b883ea6316fbe40a567bc7e3ca85035b9b03740bc1d
MD5 SHA1 SHA512

Submit Download

cpjkhm.exe

Path C:\Users\Admin\AppData\Local\Temp\cpjkhm.exe
Size 4KB
SHA256 4921031a6f9c7d20fe0a849eee9f16d792733fd34f32b346ac43098421093c43
MD5 c910a97bac72a537aa24144427c69290
SHA1 98382514ee34de89bdf8da5e0c136c5d0cb4097a
SHA512 2440c8fa743ba50b3ed973fb514e5a636a0aad82fafa48415e840df18f44d6553d450edad7cb417623288b883ea6316fbe40a567bc7e3ca85035b9b03740bc1d
MD5 SHA1 SHA512

Submit Download

rsrpwoa

Path C:\Users\Admin\AppData\Local\Temp\rsrpwoa
Size 5KB
SHA256 f819a228776b0f2f3b5842b4bd88ab443c7fb653e0ff956f4901d684d3bbe8c3
MD5 b1eb9cee4d231da2b61529d7d08e1462
SHA1 a5899d003c42eb8217bf3ef0c6e5795817ee601b
SHA512 8190ae6716d0aa64af9f44990faaee1b7c27fc8881006dcd43a02de03a93f21ddf7757084c601b4cf450e2e61d7e714283e8be23f4d0ff533b5a913800078f7f
SSDEEP 96:7q0TH41F2d1W2fN0fVG0gCGViJ+SPVCVp/:Zb4/2d1W2VUtkip45
MD5 SHA1 SHA512 SSDEEP

Submit Download

cpjkhm.exe

Path \Users\Admin\AppData\Local\Temp\cpjkhm.exe
Size 4KB
SHA256 4921031a6f9c7d20fe0a849eee9f16d792733fd34f32b346ac43098421093c43
MD5 c910a97bac72a537aa24144427c69290
SHA1 98382514ee34de89bdf8da5e0c136c5d0cb4097a
SHA512 2440c8fa743ba50b3ed973fb514e5a636a0aad82fafa48415e840df18f44d6553d450edad7cb417623288b883ea6316fbe40a567bc7e3ca85035b9b03740bc1d
MD5 SHA1 SHA512

Submit Download

cpjkhm.exe

Path \Users\Admin\AppData\Local\Temp\cpjkhm.exe
Size 4KB
SHA256 4921031a6f9c7d20fe0a849eee9f16d792733fd34f32b346ac43098421093c43
MD5 c910a97bac72a537aa24144427c69290
SHA1 98382514ee34de89bdf8da5e0c136c5d0cb4097a
SHA512 2440c8fa743ba50b3ed973fb514e5a636a0aad82fafa48415e840df18f44d6553d450edad7cb417623288b883ea6316fbe40a567bc7e3ca85035b9b03740bc1d
MD5 SHA1 SHA512

Submit Download

memory/988-63-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/988-68-0x0000000000920000-0x0000000000C23000-memory.dmp

Download

memory/988-69-0x00000000002C0000-0x00000000002D1000-memory.dmp

Download

memory/988-67-0x0000000000400000-0x000000000042A000-memory.dmp

Download

memory/1200-70-0x0000000004B00000-0x0000000004C63000-memory.dmp

Download

memory/1200-77-0x0000000004C70000-0x0000000004DAF000-memory.dmp

Download

memory/1376-54-0x0000000075361000-0x0000000075363000-memory.dmp

Download

memory/2004-73-0x0000000000E20000-0x0000000000E46000-memory.dmp

Download

memory/2004-74-0x0000000000070000-0x000000000009A000-memory.dmp

Download

memory/2004-75-0x0000000002250000-0x0000000002553000-memory.dmp

Download

memory/2004-76-0x00000000009C0000-0x0000000000A50000-memory.dmp

Download