xloader | e0f6a62ae1dfbd451655ef46b2d3f3267edd04fab1b9683a7087cfb89d40545d

General

Target

Quotation.exe
Size

576KB
MD5

e1ebd51a52544a2ca2b2f8ac9a47a31c
SHA1

78c4acc43fedb4bf54220c7382b9a45c768aca3e
SHA256

f079d07d554c8fb387b3b5d040adb87504417def132f6e04578ecc0afd01eae6
SHA512

9bd32196620058a335ade12b0af4b94cddd37d2ed88004f1191e4f4fd7b805d6ebdad906c092c6d3d6e4859fa6ebd1902c0e9e15a29eeda7da1f1593797d7486
SSDEEP

12288:EzeaAF5gj58O4iwrhCB+jl9y1v2riq09qNZQNKF2AUjg7dA:E4gWO4vCBUg2rn091tA0gBA

Score

10^/10

xloader uidr loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

uidr

Decoy

dulichsongcham.com

cash-royal.com

geneseewildlifetrapping.com

9cc9x79m3y2.com

ntjjzx.com

joinglooko.com

upmchealhtrak.com

hookandcask.com

orca-web.com

ag3holdings.com

empoweredinvestmentstx.com

lustywall.com

rcpelaurentides.com

goyalcoorchidnirvanatwo.homes

iotajinn.com

littlemlive.com

hippocratesbio.com

ashleysema.design

175a45.xyz

bpocompaniesphilippines.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/2612-11-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/2612-16-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/2604-21-0x0000000000080000-0x00000000000A8000-memory.dmp	xloader

Deletes itself 1 IoCs

pid	Process
2896	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2440 set thread context of 2612	2440	Quotation.exe	30
PID 2612 set thread context of 1368	2612	Quotation.exe	21
PID 2604 set thread context of 1368	2604	ipconfig.exe	21

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2604	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2612	Quotation.exe
2612	Quotation.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2612	Quotation.exe
2612	Quotation.exe
2612	Quotation.exe
2604	ipconfig.exe
2604	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2612	Quotation.exe
Token: SeDebugPrivilege	2604	ipconfig.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2612	2440	Quotation.exe	30
PID 2440 wrote to memory of 2612	2440	Quotation.exe	30
PID 2440 wrote to memory of 2612	2440	Quotation.exe	30
PID 2440 wrote to memory of 2612	2440	Quotation.exe	30
PID 2440 wrote to memory of 2612	2440	Quotation.exe	30
PID 2440 wrote to memory of 2612	2440	Quotation.exe	30
PID 2440 wrote to memory of 2612	2440	Quotation.exe	30
PID 1368 wrote to memory of 2604	1368	Explorer.EXE	31
PID 1368 wrote to memory of 2604	1368	Explorer.EXE	31
PID 1368 wrote to memory of 2604	1368	Explorer.EXE	31
PID 1368 wrote to memory of 2604	1368	Explorer.EXE	31
PID 2604 wrote to memory of 2896	2604	ipconfig.exe	32
PID 2604 wrote to memory of 2896	2604	ipconfig.exe	32
PID 2604 wrote to memory of 2896	2604	ipconfig.exe	32
PID 2604 wrote to memory of 2896	2604	ipconfig.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\AppData\Local\Temp\Quotation.exe
  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Users\Admin\AppData\Local\Temp\Quotation.exe
    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2612
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\SysWOW64\ipconfig.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Gathers network information
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
    3⤵
    - Deletes itself
    PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-17-0x00000000030E0000-0x00000000031E0000-memory.dmp

Filesize
1024KB

Download
memory/1368-24-0x00000000045A0000-0x0000000004673000-memory.dmp

Filesize
844KB

Download
memory/1368-18-0x00000000045A0000-0x0000000004673000-memory.dmp

Filesize
844KB

Download
memory/2440-5-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2440-3-0x0000000000880000-0x000000000088A000-memory.dmp

Filesize
40KB

Download
memory/2440-0-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

Filesize
4KB

Download
memory/2440-6-0x0000000004D00000-0x0000000004D5E000-memory.dmp

Filesize
376KB

Download
memory/2440-1-0x0000000000A00000-0x0000000000A96000-memory.dmp

Filesize
600KB

Download
memory/2440-4-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

Filesize
4KB

Download
memory/2440-12-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2440-2-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2604-21-0x0000000000080000-0x00000000000A8000-memory.dmp

Filesize
160KB

Download
memory/2604-20-0x0000000000C10000-0x0000000000C1A000-memory.dmp

Filesize
40KB

Download
memory/2604-19-0x0000000000C10000-0x0000000000C1A000-memory.dmp

Filesize
40KB

Download
memory/2612-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2612-14-0x0000000000AA0000-0x0000000000DA3000-memory.dmp

Filesize
3.0MB

Download
memory/2612-15-0x0000000000160000-0x0000000000170000-memory.dmp

Filesize
64KB

Download
memory/2612-16-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2612-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2612-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2612-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing