xloader | f51f3c1fb71a3301e0716e9025bc063e8f1aeb7c3b1bb5570f9e159f86eb67be

General

Target

ScanDoc_pdf.exe
Size

296KB
MD5

de0a385641f08128deab9ec88a298d28
SHA1

5f51c8ce26b59ebed00f23ccc4fe696272a0bf07
SHA256

b1999a87350ef2b15e663c809ac16f2f0832ba3dcd868aefe0d36392af04da29
SHA512

8d93ba4cb7c68426b4441f2950128646fb136285ef6863f0d0c2e08c368c1174d467937a423946e95b1f5fec6213cf6127c666c143c6d5d77d932e64dd1958b2
SSDEEP

6144:Wx/MriVFI8E0P9Qsa8vJXlPqC8A8e1+uaisJPM:qFo8E0lE8h1CJA8Wai6M

Score

10^/10

xloader gzcj loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

gzcj

Decoy

localzhops.com

cfsb114.com

sweetiefilms.com

cyclewatts.com

bubblesportsevent.com

halloween-r-us.com

rcdzsm.com

reelatioens.com

uniquegranitebenefits.com

chainlinkdex.com

topcoolhlist.com

ivy-apps.com

shopmajesticqueendom.com

ddiesels.com

ventajuguetessexuales.online

daylight93245.com

heiyingxitong.com

personalfashion.guru

usadrugfree.com

beyondcareersuccess.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/2576-12-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2576-15-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2968-21-0x00000000000C0000-0x00000000000E9000-memory.dmp	xloader

Deletes itself 1 IoCs

pid	Process
2064	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2308	ScanDoc_pdf.exe
2308	ScanDoc_pdf.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2308 set thread context of 2576	2308	ScanDoc_pdf.exe	30
PID 2576 set thread context of 1280	2576	ScanDoc_pdf.exe	21
PID 2968 set thread context of 1280	2968	wlanext.exe	21

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2308	ScanDoc_pdf.exe
2308	ScanDoc_pdf.exe
2308	ScanDoc_pdf.exe
2308	ScanDoc_pdf.exe
2576	ScanDoc_pdf.exe
2576	ScanDoc_pdf.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe
2968	wlanext.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2308	ScanDoc_pdf.exe
2576	ScanDoc_pdf.exe
2576	ScanDoc_pdf.exe
2576	ScanDoc_pdf.exe
2968	wlanext.exe
2968	wlanext.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2576	ScanDoc_pdf.exe
Token: SeDebugPrivilege	2968	wlanext.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2576	2308	ScanDoc_pdf.exe	30
PID 2308 wrote to memory of 2576	2308	ScanDoc_pdf.exe	30
PID 2308 wrote to memory of 2576	2308	ScanDoc_pdf.exe	30
PID 2308 wrote to memory of 2576	2308	ScanDoc_pdf.exe	30
PID 2308 wrote to memory of 2576	2308	ScanDoc_pdf.exe	30
PID 1280 wrote to memory of 2968	1280	Explorer.EXE	31
PID 1280 wrote to memory of 2968	1280	Explorer.EXE	31
PID 1280 wrote to memory of 2968	1280	Explorer.EXE	31
PID 1280 wrote to memory of 2968	1280	Explorer.EXE	31
PID 2968 wrote to memory of 2064	2968	wlanext.exe	32
PID 2968 wrote to memory of 2064	2968	wlanext.exe	32
PID 2968 wrote to memory of 2064	2968	wlanext.exe	32
PID 2968 wrote to memory of 2064	2968	wlanext.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Users\Admin\AppData\Local\Temp\ScanDoc_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\ScanDoc_pdf.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Users\Admin\AppData\Local\Temp\ScanDoc_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\ScanDoc_pdf.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- C:\Windows\SysWOW64\wlanext.exe
  "C:\Windows\SysWOW64\wlanext.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\ScanDoc_pdf.exe"
    3⤵
    - Deletes itself
    PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\6xvjduoucppa.dll

Filesize
11KB

MD5
5c05b7632a19f8b04717a76aae9e2659

SHA1
a4b1062e88f9170917ec5a9b251bd739f995c3c8

SHA256
b574aefc953483b2e57dca1653bfec41d14d0c0d460a0e7e778e943d4a1ce364

SHA512
eaef74792c64f675add11a6392e32e2eed47701add80ac9945301324057aa8778e9afbd3588109a578f3da1ff09000b1c80756ab9b7f6c5f5ef27dde7fb531ce

Download Submit
\Users\Admin\AppData\Local\Temp\nsd94F0.tmp\System.dll

Filesize
11KB

MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
memory/1280-16-0x0000000006830000-0x0000000006940000-memory.dmp

Filesize
1.1MB

Download
memory/1280-24-0x0000000006830000-0x0000000006940000-memory.dmp

Filesize
1.1MB

Download
memory/2308-11-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/2308-13-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/2576-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2576-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2968-19-0x0000000000FA0000-0x0000000000FB6000-memory.dmp

Filesize
88KB

Download
memory/2968-20-0x0000000000FA0000-0x0000000000FB6000-memory.dmp

Filesize
88KB

Download
memory/2968-21-0x00000000000C0000-0x00000000000E9000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing