xloader | af734d11eb2809d171ff3e63096cb2cbd38ee44a6e4b9e0ab195498635208598

General

Target

SecuriteInfo.com.W32.AIDetectNet.01.19961.exe
Size

448KB
MD5

4cfcb2976dc600ecd5e61ee012d2cf80
SHA1

bb6405e828b4f43846e2bf5dcfda7ccad2c204a3
SHA256

af734d11eb2809d171ff3e63096cb2cbd38ee44a6e4b9e0ab195498635208598
SHA512

9743553db9ce03ba401b14e9c018957b94e6b42ed2cf430432ef2d9fa7343ce1b16439842457465ad1d0960a3ee72881b130f8a35cce06b2e1475e1b2f03d6a2

Score

10^/10

xloader r87g loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

r87g

Decoy

gzjyjzsj.com

rapibest.com

affordablebathroomsbyfrank.net

roboruben.com

xn--dlisucr-byag.com

encoreasso.com

piscire.com

dixiebusybee.com

newrome.xyz

sunshinejon.com

glacierforfcs.xyz

borhanmarket.com

tous-des-cons.club

hsfstea.com

spiniform.info

vaicomfibra.com

shinigami.xyz

kryptoindia.com

listentoappetite.com

securepplpay.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/608-68-0x000000000041D480-mapping.dmp	xloader
behavioral1/memory/608-67-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.W32.AIDetectNet.01.19961.exe

description	pid	process	target process
PID 1720 set thread context of 608	1720	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1332 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exeSecuriteInfo.com.W32.AIDetectNet.01.19961.exe

pid process

1680 powershell.exe
608 SecuriteInfo.com.W32.AIDetectNet.01.19961.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1680 powershell.exe

pid	process
1332	schtasks.exe

pid	process
1680	powershell.exe
608	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe

description	pid	process
Token: SeDebugPrivilege	1680	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

SecuriteInfo.com.W32.AIDetectNet.01.19961.exe

description	pid	process	target process
PID 1720 wrote to memory of 1680	1720	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe	powershell.exe
PID 1720 wrote to memory of 1680	1720	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe	powershell.exe
PID 1720 wrote to memory of 1680	1720	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe	powershell.exe
PID 1720 wrote to memory of 1680	1720	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe	powershell.exe
PID 1720 wrote to memory of 1332	1720	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe	schtasks.exe
PID 1720 wrote to memory of 1332	1720	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe	schtasks.exe
PID 1720 wrote to memory of 1332	1720	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe	schtasks.exe
PID 1720 wrote to memory of 1332	1720	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe	schtasks.exe
PID 1720 wrote to memory of 608	1720	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe
PID 1720 wrote to memory of 608	1720	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe
PID 1720 wrote to memory of 608	1720	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe
PID 1720 wrote to memory of 608	1720	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe
PID 1720 wrote to memory of 608	1720	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe
PID 1720 wrote to memory of 608	1720	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe
PID 1720 wrote to memory of 608	1720	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe	SecuriteInfo.com.W32.AIDetectNet.01.19961.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19961.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19961.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hJzNgUBNjbq.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hJzNgUBNjbq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9483.tmp"
2⤵
- Creates scheduled task(s)
PID:1332

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19961.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19961.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:608

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9483.tmp
Filesize
1KB

MD5
fd9f3ced80110000d1af39ff9814d8e8

SHA1
abbee2f74f774a3bca49ef85fc05848c097c1dc8

SHA256
b761ce2df7f31189a9fb85189b40a777c76d78ca15e759663bf746ab1dac3918

SHA512
2046d52588c71c3c193560551a7cf8a6e088ee2ac064c8d0b746fb8039d94acfb7af4764620d0a5e6d218ab2a3b7d5016d3bab0f0b565bcb7950ae948e3e7276

Download Submit
memory/608-64-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/608-65-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/608-69-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Filesize
3.0MB

Download
memory/608-67-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/608-68-0x000000000041D480-mapping.dmp

Download
memory/1332-59-0x0000000000000000-mapping.dmp

Download
memory/1680-62-0x000000006ED30000-0x000000006F2DB000-memory.dmp

Filesize
5.7MB

Download
memory/1680-58-0x0000000000000000-mapping.dmp

Download
memory/1680-70-0x000000006ED30000-0x000000006F2DB000-memory.dmp

Filesize
5.7MB

Download
memory/1720-63-0x0000000000E90000-0x0000000000EC0000-memory.dmp

Filesize
192KB

Download
memory/1720-54-0x0000000000ED0000-0x0000000000F40000-memory.dmp

Filesize
448KB

Download
memory/1720-55-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1720-56-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1720-57-0x0000000005100000-0x0000000005166000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads