xloader | 7d850c7483817ae91c6b6dde59c22141b754d04ec2e0985ffcd85b08f2e9ae58

General

Target

79f342dceff76485db960d4e9de522f2.exe
Size

243KB
MD5

79f342dceff76485db960d4e9de522f2
SHA1

e54b0ca25b62d3f377b68d3037ff4d78350a627b
SHA256

7d850c7483817ae91c6b6dde59c22141b754d04ec2e0985ffcd85b08f2e9ae58
SHA512

548ab3961741ffec55a593b26bbc383e7afbae20509f475e46ecf3470334d6c125d6fc0e6ef5fd4f85eccd2492db8320628228e5c1bc5dd89ed5822bb958c1a5
SSDEEP

6144:cFgRqbsZzgQvSwEMFusUCj2eY7UBytn4/oOshpgfMc:qsZz+lMksdG7UBa4/o3kMc

Score

10^/10

xloader zgtb loader persistence rat

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

zgtb

Decoy

gabriellep.com

honghe4.xyz

anisaofrendas.com

happy-tile.com

thesulkies.com

international-ipo.com

tazeco.info

hhhzzz.xyz

vrmonster.xyz

theearthresidencia.com

sportape.xyz

elshadaibaterias.com

koredeiihibi.com

taxtaa.com

globalcityb.com

fxivcama.com

dagsmith.com

elmar-bhp.com

peakice.net

jhcdjewelry.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/588-61-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral1/memory/588-62-0x000000000041F1F0-mapping.dmp	xloader
behavioral1/memory/588-68-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral1/memory/1552-71-0x00000000000E0000-0x000000000010B000-memory.dmp	xloader
behavioral1/memory/1552-75-0x00000000000E0000-0x000000000010B000-memory.dmp	xloader

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wuapp.exe

description	ioc	process
Key created	\Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	wuapp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TPLX0NNHWF = "C:\\Program Files (x86)\\Pebgx\\audiodglbcpzl.exe"	wuapp.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

79f342dceff76485db960d4e9de522f2.execvtres.exewuapp.exe

description	pid	process	target process
PID 1976 set thread context of 588	1976	79f342dceff76485db960d4e9de522f2.exe	cvtres.exe
PID 588 set thread context of 1284	588	cvtres.exe	Explorer.EXE
PID 1552 set thread context of 1284	1552	wuapp.exe	Explorer.EXE

Drops file in Program Files directory 1 IoCs

Processes:

wuapp.exe

description ioc process

File opened for modification C:\Program Files (x86)\Pebgx\audiodglbcpzl.exe wuapp.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Pebgx\audiodglbcpzl.exe	wuapp.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

wuapp.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wuapp.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

cvtres.exewuapp.exe

pid	process
588	cvtres.exe
588	cvtres.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe
1552	wuapp.exe

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

cvtres.exewuapp.exe

pid process

588 cvtres.exe
588 cvtres.exe
588 cvtres.exe
1552 wuapp.exe
1552 wuapp.exe
1552 wuapp.exe
1552 wuapp.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

cvtres.exewuapp.exe

description pid process

Token: SeDebugPrivilege 588 cvtres.exe
Token: SeDebugPrivilege 1552 wuapp.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1284 Explorer.EXE
1284 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1284 Explorer.EXE
1284 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	588	cvtres.exe
Token: SeDebugPrivilege	1552	wuapp.exe

pid	process
1284	Explorer.EXE
1284	Explorer.EXE

pid	process
1284	Explorer.EXE
1284	Explorer.EXE

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

79f342dceff76485db960d4e9de522f2.exeExplorer.EXEwuapp.exe

description	pid	process	target process
PID 1976 wrote to memory of 588	1976	79f342dceff76485db960d4e9de522f2.exe	cvtres.exe
PID 1976 wrote to memory of 588	1976	79f342dceff76485db960d4e9de522f2.exe	cvtres.exe
PID 1976 wrote to memory of 588	1976	79f342dceff76485db960d4e9de522f2.exe	cvtres.exe
PID 1976 wrote to memory of 588	1976	79f342dceff76485db960d4e9de522f2.exe	cvtres.exe
PID 1976 wrote to memory of 588	1976	79f342dceff76485db960d4e9de522f2.exe	cvtres.exe
PID 1976 wrote to memory of 588	1976	79f342dceff76485db960d4e9de522f2.exe	cvtres.exe
PID 1976 wrote to memory of 588	1976	79f342dceff76485db960d4e9de522f2.exe	cvtres.exe
PID 1284 wrote to memory of 1552	1284	Explorer.EXE	wuapp.exe
PID 1284 wrote to memory of 1552	1284	Explorer.EXE	wuapp.exe
PID 1284 wrote to memory of 1552	1284	Explorer.EXE	wuapp.exe
PID 1284 wrote to memory of 1552	1284	Explorer.EXE	wuapp.exe
PID 1284 wrote to memory of 1552	1284	Explorer.EXE	wuapp.exe
PID 1284 wrote to memory of 1552	1284	Explorer.EXE	wuapp.exe
PID 1284 wrote to memory of 1552	1284	Explorer.EXE	wuapp.exe
PID 1552 wrote to memory of 1152	1552	wuapp.exe	cmd.exe
PID 1552 wrote to memory of 1152	1552	wuapp.exe	cmd.exe
PID 1552 wrote to memory of 1152	1552	wuapp.exe	cmd.exe
PID 1552 wrote to memory of 1152	1552	wuapp.exe	cmd.exe
PID 1552 wrote to memory of 1580	1552	wuapp.exe	Firefox.exe
PID 1552 wrote to memory of 1580	1552	wuapp.exe	Firefox.exe
PID 1552 wrote to memory of 1580	1552	wuapp.exe	Firefox.exe
PID 1552 wrote to memory of 1580	1552	wuapp.exe	Firefox.exe
PID 1552 wrote to memory of 1580	1552	wuapp.exe	Firefox.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1284

C:\Users\Admin\AppData\Local\Temp\79f342dceff76485db960d4e9de522f2.exe
"C:\Users\Admin\AppData\Local\Temp\79f342dceff76485db960d4e9de522f2.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:588

C:\Windows\SysWOW64\wuapp.exe
"C:\Windows\SysWOW64\wuapp.exe"
2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
3⤵
PID:1152

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:1580

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/588-64-0x0000000000930000-0x0000000000C33000-memory.dmp

Filesize
3.0MB

Download
memory/588-68-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/588-65-0x0000000000260000-0x0000000000271000-memory.dmp

Filesize
68KB

Download
memory/588-58-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/588-59-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/588-61-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/588-62-0x000000000041F1F0-mapping.dmp

Download
memory/1152-69-0x0000000000000000-mapping.dmp

Download
memory/1284-66-0x0000000003CA0000-0x0000000003D61000-memory.dmp

Filesize
772KB

Download
memory/1284-74-0x0000000004A00000-0x0000000004AE2000-memory.dmp

Filesize
904KB

Download
memory/1284-77-0x0000000004A00000-0x0000000004AE2000-memory.dmp

Filesize
904KB

Download
memory/1552-71-0x00000000000E0000-0x000000000010B000-memory.dmp

Filesize
172KB

Download
memory/1552-70-0x00000000011F0000-0x00000000011FB000-memory.dmp

Filesize
44KB

Download
memory/1552-72-0x0000000000AB0000-0x0000000000DB3000-memory.dmp

Filesize
3.0MB

Download
memory/1552-73-0x0000000000920000-0x00000000009B0000-memory.dmp

Filesize
576KB

Download
memory/1552-67-0x0000000000000000-mapping.dmp

Download
memory/1552-75-0x00000000000E0000-0x000000000010B000-memory.dmp

Filesize
172KB

Download
memory/1552-76-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/1976-56-0x0000000000470000-0x000000000047E000-memory.dmp

Filesize
56KB

Download
memory/1976-55-0x00000000003B0000-0x00000000003EC000-memory.dmp

Filesize
240KB

Download
memory/1976-57-0x0000000000480000-0x0000000000488000-memory.dmp

Filesize
32KB

Download
memory/1976-54-0x00000000001F0000-0x0000000000230000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads