xloader | c9bc1cb7f620dc0ca06cb14ac061ebc3eb9d1d31536abf66fadb5afa277c6c8d

General

Target

b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe
Size

202KB
MD5

b9753e6a4e25385083221adf8dc6d5b0
SHA1

ba627129085d90cff569c40e65649155edc0572d
SHA256

c9bc1cb7f620dc0ca06cb14ac061ebc3eb9d1d31536abf66fadb5afa277c6c8d
SHA512

6ee9bcaf5eff303ebcf7d7992635bd5244cead4051ee42a87c5fd8dbdc67786c8c2434dc5ccc5536f4f01d51d416ed3cacc4d9487ce7cfaa6c1445a0b0a79bd2
SSDEEP

3072:114/IIhEDnmJL+ulN45BwNSoRZ7HYIh5PihD1Ypwh1shYeex+tvton02:1be4zwSoRZ7vSJOiAhY+tVonn

Score

10^/10

xloader zgtb loader rat

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

zgtb

Decoy

gabriellep.com

honghe4.xyz

anisaofrendas.com

happy-tile.com

thesulkies.com

international-ipo.com

tazeco.info

hhhzzz.xyz

vrmonster.xyz

theearthresidencia.com

sportape.xyz

elshadaibaterias.com

koredeiihibi.com

taxtaa.com

globalcityb.com

fxivcama.com

dagsmith.com

elmar-bhp.com

peakice.net

jhcdjewelry.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2532-15-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral1/memory/2532-20-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral1/memory/2532-24-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral1/memory/2180-29-0x00000000000D0000-0x00000000000FB000-memory.dmp	xloader

Executes dropped EXE 2 IoCs

Processes:

hybreieskm.exehybreieskm.exe

pid	Process
2728	hybreieskm.exe
2532	hybreieskm.exe

Loads dropped DLL 3 IoCs

Processes:

b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exehybreieskm.exe

pid	Process
2292	b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe
2292	b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe
2728	hybreieskm.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

hybreieskm.exehybreieskm.exewuapp.exe

description	pid	Process	procid_target
PID 2728 set thread context of 2532	2728	hybreieskm.exe	29
PID 2532 set thread context of 1160	2532	hybreieskm.exe	20
PID 2532 set thread context of 1160	2532	hybreieskm.exe	20
PID 2180 set thread context of 1160	2180	wuapp.exe	20

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

hybreieskm.exewuapp.exe

pid	Process
2532	hybreieskm.exe
2532	hybreieskm.exe
2532	hybreieskm.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe
2180	wuapp.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

hybreieskm.exewuapp.exe

pid	Process
2532	hybreieskm.exe
2532	hybreieskm.exe
2532	hybreieskm.exe
2532	hybreieskm.exe
2180	wuapp.exe
2180	wuapp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

hybreieskm.exewuapp.exe

description	pid	Process
Token: SeDebugPrivilege	2532	hybreieskm.exe
Token: SeDebugPrivilege	2180	wuapp.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exehybreieskm.exehybreieskm.exewuapp.exe

description	pid	Process	procid_target
PID 2292 wrote to memory of 2728	2292	b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe	28
PID 2292 wrote to memory of 2728	2292	b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe	28
PID 2292 wrote to memory of 2728	2292	b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe	28
PID 2292 wrote to memory of 2728	2292	b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe	28
PID 2728 wrote to memory of 2532	2728	hybreieskm.exe	29
PID 2728 wrote to memory of 2532	2728	hybreieskm.exe	29
PID 2728 wrote to memory of 2532	2728	hybreieskm.exe	29
PID 2728 wrote to memory of 2532	2728	hybreieskm.exe	29
PID 2728 wrote to memory of 2532	2728	hybreieskm.exe	29
PID 2728 wrote to memory of 2532	2728	hybreieskm.exe	29
PID 2728 wrote to memory of 2532	2728	hybreieskm.exe	29
PID 2532 wrote to memory of 2180	2532	hybreieskm.exe	43
PID 2532 wrote to memory of 2180	2532	hybreieskm.exe	43
PID 2532 wrote to memory of 2180	2532	hybreieskm.exe	43
PID 2532 wrote to memory of 2180	2532	hybreieskm.exe	43
PID 2532 wrote to memory of 2180	2532	hybreieskm.exe	43
PID 2532 wrote to memory of 2180	2532	hybreieskm.exe	43
PID 2532 wrote to memory of 2180	2532	hybreieskm.exe	43
PID 2180 wrote to memory of 2408	2180	wuapp.exe	44
PID 2180 wrote to memory of 2408	2180	wuapp.exe	44
PID 2180 wrote to memory of 2408	2180	wuapp.exe	44
PID 2180 wrote to memory of 2408	2180	wuapp.exe	44

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1160
- C:\Users\Admin\AppData\Local\Temp\b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\b9753e6a4e25385083221adf8dc6d5b0_NeikiAnalytics.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Users\Admin\AppData\Local\Temp\hybreieskm.exe
    C:\Users\Admin\AppData\Local\Temp\hybreieskm.exe C:\Users\Admin\AppData\Local\Temp\lxeorr
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\hybreieskm.exe
      C:\Users\Admin\AppData\Local\Temp\hybreieskm.exe C:\Users\Admin\AppData\Local\Temp\lxeorr
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2532
    - - C:\Windows\SysWOW64\autofmt.exe
        
        "C:\Windows\SysWOW64\autofmt.exe"
        5⤵
        
        PID:2604
    - - C:\Windows\SysWOW64\autofmt.exe
        
        "C:\Windows\SysWOW64\autofmt.exe"
        5⤵
        
        PID:2992
    - - C:\Windows\SysWOW64\autofmt.exe
        
        "C:\Windows\SysWOW64\autofmt.exe"
        5⤵
        
        PID:2700
    - - C:\Windows\SysWOW64\autofmt.exe
        
        "C:\Windows\SysWOW64\autofmt.exe"
        5⤵
        
        PID:2508
    - - C:\Windows\SysWOW64\autofmt.exe
        
        "C:\Windows\SysWOW64\autofmt.exe"
        5⤵
        
        PID:2428
    - - C:\Windows\SysWOW64\autofmt.exe
        
        "C:\Windows\SysWOW64\autofmt.exe"
        5⤵
        
        PID:2608
    - - C:\Windows\SysWOW64\autofmt.exe
        
        "C:\Windows\SysWOW64\autofmt.exe"
        5⤵
        
        PID:2744
    - - C:\Windows\SysWOW64\autofmt.exe
        
        "C:\Windows\SysWOW64\autofmt.exe"
        5⤵
        
        PID:2416
    - - C:\Windows\SysWOW64\autofmt.exe
        
        "C:\Windows\SysWOW64\autofmt.exe"
        5⤵
        
        PID:2432
    - - C:\Windows\SysWOW64\autofmt.exe
        
        "C:\Windows\SysWOW64\autofmt.exe"
        5⤵
        
        PID:2528
    - - C:\Windows\SysWOW64\autofmt.exe
        
        "C:\Windows\SysWOW64\autofmt.exe"
        5⤵
        
        PID:2560
    - - C:\Windows\SysWOW64\autofmt.exe
        
        "C:\Windows\SysWOW64\autofmt.exe"
        5⤵
        
        PID:2436
    - - C:\Windows\SysWOW64\autofmt.exe
        
        "C:\Windows\SysWOW64\autofmt.exe"
        5⤵
        
        PID:2664
    - - C:\Windows\SysWOW64\wuapp.exe
        
        "C:\Windows\SysWOW64\wuapp.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2180
      - C:\Windows\SysWOW64\cmd.exe
        
        /c del "C:\Users\Admin\AppData\Local\Temp\hybreieskm.exe"
        6⤵
        
        PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4508gpe9olqt7rpyqk

Filesize
170KB

MD5
2cba243abe4f15a1468c887af14f925c

SHA1
c42e155ac1a099da7d4ead3224b5163f43215eb2

SHA256
05b544eeab9c1ecb01eada8459f9d4c2d928832958e20ceef5c06327cdf4fa17

SHA512
e70258ade62f173c8b124e4aecf2d3b286bda069a593a7ce49f77856435fa02468e9a0ff2224d828df5073efae7ff638ca6a07657717b19ee9943e231ba65871

Download Submit
C:\Users\Admin\AppData\Local\Temp\lxeorr

Filesize
5KB

MD5
9a5a52d30c37e2f7afbb9781a418e1c4

SHA1
775d7a12959d6b01344e4d8484cfa7c058610df4

SHA256
e250b16974bcc0c304867b4b625d9718c4258653103678e08b4b14004266eb90

SHA512
fc1d0db987bbde4c97d4d5e90b557378230d3d35ac453535366076d04566aa3e45713c4e836270bab57f9f92a056eff354e51a721471ff79b3e2bc8ad8538bdf

Download Submit
\Users\Admin\AppData\Local\Temp\hybreieskm.exe

Filesize
5KB

MD5
3fe13edd25a0779eb87727b4ce3d7818

SHA1
16527b946c3694d83d3e7d8c452ad681a678208f

SHA256
fce6d2715739d7b855a83771d1c6a3e2822d625ca490b990a2908afba8df1dfe

SHA512
fd2b1a8cbd4bc408d3ca283389ba4a87c8421837f8edfe3b98e1bf9ca3a478369103f8cc57a8f8b3d364e637b30c3eafd423249b5ceb4f2e3cc13ca02db44cf4

Download Submit
memory/1160-21-0x0000000006930000-0x0000000006A7A000-memory.dmp

Filesize
1.3MB

Download
memory/1160-30-0x0000000006D00000-0x0000000006E21000-memory.dmp

Filesize
1.1MB

Download
memory/1160-26-0x0000000006D00000-0x0000000006E21000-memory.dmp

Filesize
1.1MB

Download
memory/2180-28-0x00000000013D0000-0x00000000013DB000-memory.dmp

Filesize
44KB

Download
memory/2180-27-0x00000000013D0000-0x00000000013DB000-memory.dmp

Filesize
44KB

Download
memory/2180-29-0x00000000000D0000-0x00000000000FB000-memory.dmp

Filesize
172KB

Download
memory/2532-19-0x0000000000140000-0x0000000000151000-memory.dmp

Filesize
68KB

Download
memory/2532-20-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2532-18-0x0000000000850000-0x0000000000B53000-memory.dmp

Filesize
3.0MB

Download
memory/2532-25-0x0000000000240000-0x0000000000251000-memory.dmp

Filesize
68KB

Download
memory/2532-24-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2532-15-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2728-12-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads