xloader | a7c1f4ae5c35b88e68b4d82db4c7e14d53922946d853569b5efd5050e7480229

Analysis

max time kernel
152s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2022 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35.exe
Size

176KB
MD5

675b7c7ed756d2c9bd3319802029a228
SHA1

31b44c6668f81a997cfe99c240a8d9ecd35cbef4
SHA256

a16f939e9b65316cddd172484406394ebda2fed078d611d774b942daa6c239dc
SHA512

776753c4aba10b83f995580940e1100c88999514e25edf2c172073c2f130d98b92e36d0364b91dc16b97e26263c191f7e025778849b1c8255078234cfbe2e861
SSDEEP

3072:bQ9NMqbEzJhsadCKYQIhWEGr+pTJB1qdKXhDD4q0yW6xPJNnwN5GSBCV0BVEm:bcMKQ+aUYIkr+lJ7qIXhDD4q0yHBNnwa

Score

10^/10

xloader loader rat

Malware Config

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral3/memory/4848-137-0x0000000000620000-0x000000000064C000-memory.dmp	xloader
behavioral3/memory/4848-142-0x0000000000620000-0x000000000064C000-memory.dmp	xloader

Blocklisted process makes network request 2 IoCs

Processes:

cmd.exe

flow pid process

74 4848 cmd.exe
88 4848 cmd.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

35.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 35.exe
Suspicious use of SetThreadContext 2 IoCs

Processes:

35.execmd.exe

description pid process target process

PID 4728 set thread context of 684 4728 35.exe Explorer.EXE
PID 4848 set thread context of 684 4848 cmd.exe Explorer.EXE

flow	pid	process
74	4848	cmd.exe
88	4848	cmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	35.exe

description	pid	process	target process
PID 4728 set thread context of 684	4728	35.exe	Explorer.EXE
PID 4848 set thread context of 684	4848	cmd.exe	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 62 IoCs

Processes:

35.execmd.exe

pid	process
4728	35.exe
4728	35.exe
4728	35.exe
4728	35.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe
4848	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

684 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

35.execmd.exe

pid process

4728 35.exe
4728 35.exe
4728 35.exe
4848 cmd.exe
4848 cmd.exe

pid	process
684	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

35.execmd.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	4728	35.exe
Token: SeDebugPrivilege	4848	cmd.exe
Token: SeShutdownPrivilege	684	Explorer.EXE
Token: SeCreatePagefilePrivilege	684	Explorer.EXE
Token: SeShutdownPrivilege	684	Explorer.EXE
Token: SeCreatePagefilePrivilege	684	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

684 Explorer.EXE
684 Explorer.EXE

pid	process
684	Explorer.EXE
684	Explorer.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Explorer.EXEcmd.exe

description	pid	process	target process
PID 684 wrote to memory of 4848	684	Explorer.EXE	cmd.exe
PID 684 wrote to memory of 4848	684	Explorer.EXE	cmd.exe
PID 684 wrote to memory of 4848	684	Explorer.EXE	cmd.exe
PID 4848 wrote to memory of 3404	4848	cmd.exe	cmd.exe
PID 4848 wrote to memory of 3404	4848	cmd.exe	cmd.exe
PID 4848 wrote to memory of 3404	4848	cmd.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:684

C:\Users\Admin\AppData\Local\Temp\35.exe
"C:\Users\Admin\AppData\Local\Temp\35.exe"
2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\35.exe"
3⤵
PID:3404

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/684-134-0x0000000003010000-0x00000000030D7000-memory.dmp

Filesize
796KB

Download
memory/684-141-0x00000000081F0000-0x00000000082E1000-memory.dmp

Filesize
964KB

Download
memory/684-143-0x00000000081F0000-0x00000000082E1000-memory.dmp

Filesize
964KB

Download
memory/3404-139-0x0000000000000000-mapping.dmp

Download
memory/4728-132-0x0000000001110000-0x000000000145A000-memory.dmp

Filesize
3.3MB

Download
memory/4728-133-0x00000000010D0000-0x00000000010E1000-memory.dmp

Filesize
68KB

Download
memory/4848-135-0x0000000000000000-mapping.dmp

Download
memory/4848-136-0x00000000006D0000-0x000000000072A000-memory.dmp

Filesize
360KB

Download
memory/4848-137-0x0000000000620000-0x000000000064C000-memory.dmp

Filesize
176KB

Download
memory/4848-138-0x00000000010B0000-0x00000000013FA000-memory.dmp

Filesize
3.3MB

Download
memory/4848-140-0x0000000000E50000-0x0000000000EE0000-memory.dmp

Filesize
576KB

Download
memory/4848-142-0x0000000000620000-0x000000000064C000-memory.dmp

Filesize
176KB

Download