xloader | a1dc18b320d5f906df53dcc7a4d4e547b2ad6707e9484eafb3c8a8855c98a9b0

General

Target

IMG_501327.exe
Size

462KB
MD5

1f11cb76d8f9643820a756448b4b3a0e
SHA1

c00db72ff5681b1f26db430a71b35dcfe3978d1c
SHA256

aaf1000d1f4822bb6e7424123c807a333a8696783ab029b49df8250b115c27ae
SHA512

2e1c2c46233b1a995e234ff7dd5a876a2230e06dc5ee6da3fdd3a890ce2f43bb57e0faee14c3094c80d99f435d42b7e13c845d885f82c2b2d31961cc1db2b3cc
SSDEEP

12288:pFda+FdagEMYLZsUN8dgHgY8RfuydvDZ0da7Af:bEMfrdc8Zhdd

Score

10^/10

xloader mt6e execution loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

mt6e

Decoy

morozolga.com

selimtokdemir.com

deluxeweldingsupply.com

allannateddyrose.com

iconsneakersfr.com

vicenteconchilla.com

themediatenow.com

finishmybasemint.com

blaseskincare.com

betwho.site

madewithrealmeat.com

scratchpatchinc.com

daysad.com

kraftwater.com

prolifictrades.com

usdtmgm.com

mooneworms.com

grandspecialiste.com

mirzaassociates.com

bilaltahirofficial.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Beds Protector Packer 1 IoCs

Detects Beds Protector packer used to load .NET malware.

Processes:

resource	yara_rule
behavioral1/memory/1676-3-0x0000000000400000-0x000000000045E000-memory.dmp	beds_protector

Xloader payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2732-21-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2732-26-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2632-30-0x00000000000D0000-0x00000000000F9000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
2468	cmd.exe

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe	Powershell.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

IMG_501327.exeIMG_501327.exemsiexec.exe

description	pid	Process	procid_target
PID 1676 set thread context of 2732	1676	IMG_501327.exe	32
PID 2732 set thread context of 1196	2732	IMG_501327.exe	21
PID 2632 set thread context of 1196	2632	msiexec.exe	21

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

Powershell.exe

pid	Process
2680	Powershell.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

Powershell.exeIMG_501327.exemsiexec.exe

pid	Process
2680	Powershell.exe
2732	IMG_501327.exe
2732	IMG_501327.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe
2632	msiexec.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

IMG_501327.exemsiexec.exe

pid	Process
2732	IMG_501327.exe
2732	IMG_501327.exe
2732	IMG_501327.exe
2632	msiexec.exe
2632	msiexec.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Powershell.exeIMG_501327.exemsiexec.exe

description	pid	Process
Token: SeDebugPrivilege	2680	Powershell.exe
Token: SeDebugPrivilege	2732	IMG_501327.exe
Token: SeDebugPrivilege	2632	msiexec.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

IMG_501327.exeExplorer.EXEmsiexec.exe

description	pid	Process	procid_target
PID 1676 wrote to memory of 2680	1676	IMG_501327.exe	30
PID 1676 wrote to memory of 2680	1676	IMG_501327.exe	30
PID 1676 wrote to memory of 2680	1676	IMG_501327.exe	30
PID 1676 wrote to memory of 2680	1676	IMG_501327.exe	30
PID 1676 wrote to memory of 2732	1676	IMG_501327.exe	32
PID 1676 wrote to memory of 2732	1676	IMG_501327.exe	32
PID 1676 wrote to memory of 2732	1676	IMG_501327.exe	32
PID 1676 wrote to memory of 2732	1676	IMG_501327.exe	32
PID 1676 wrote to memory of 2732	1676	IMG_501327.exe	32
PID 1676 wrote to memory of 2732	1676	IMG_501327.exe	32
PID 1676 wrote to memory of 2732	1676	IMG_501327.exe	32
PID 1676 wrote to memory of 2732	1676	IMG_501327.exe	32
PID 1676 wrote to memory of 2732	1676	IMG_501327.exe	32
PID 1676 wrote to memory of 2732	1676	IMG_501327.exe	32
PID 1196 wrote to memory of 2632	1196	Explorer.EXE	33
PID 1196 wrote to memory of 2632	1196	Explorer.EXE	33
PID 1196 wrote to memory of 2632	1196	Explorer.EXE	33
PID 1196 wrote to memory of 2632	1196	Explorer.EXE	33
PID 1196 wrote to memory of 2632	1196	Explorer.EXE	33
PID 1196 wrote to memory of 2632	1196	Explorer.EXE	33
PID 1196 wrote to memory of 2632	1196	Explorer.EXE	33
PID 2632 wrote to memory of 2468	2632	msiexec.exe	34
PID 2632 wrote to memory of 2468	2632	msiexec.exe	34
PID 2632 wrote to memory of 2468	2632	msiexec.exe	34
PID 2632 wrote to memory of 2468	2632	msiexec.exe	34

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\IMG_501327.exe
  "C:\Users\Admin\AppData\Local\Temp\IMG_501327.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
    "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\IMG_501327.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Drivers.exe'
    3⤵
    - Drops startup file
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2680
- - C:\Users\Admin\AppData\Local\Temp\IMG_501327.exe
    "C:\Users\Admin\AppData\Local\Temp\IMG_501327.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2732
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\IMG_501327.exe"
    3⤵
    - Deletes itself
    PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-34-0x00000000070A0000-0x0000000007237000-memory.dmp

Filesize
1.6MB

Download
memory/1196-25-0x00000000070A0000-0x0000000007237000-memory.dmp

Filesize
1.6MB

Download
memory/1676-0-0x0000000073F7E000-0x0000000073F7F000-memory.dmp

Filesize
4KB

Download
memory/1676-3-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1676-4-0x0000000073F7E000-0x0000000073F7F000-memory.dmp

Filesize
4KB

Download
memory/1676-5-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/1676-22-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/1676-2-0x0000000073F70000-0x000000007465E000-memory.dmp

Filesize
6.9MB

Download
memory/1676-14-0x00000000004C0000-0x00000000004D6000-memory.dmp

Filesize
88KB

Download
memory/1676-1-0x0000000000CF0000-0x0000000000D6A000-memory.dmp

Filesize
488KB

Download
memory/2632-30-0x00000000000D0000-0x00000000000F9000-memory.dmp

Filesize
164KB

Download
memory/2632-29-0x0000000000610000-0x0000000000624000-memory.dmp

Filesize
80KB

Download
memory/2632-27-0x0000000000610000-0x0000000000624000-memory.dmp

Filesize
80KB

Download
memory/2680-8-0x000000006EDF1000-0x000000006EDF2000-memory.dmp

Filesize
4KB

Download
memory/2680-13-0x000000006EDF0000-0x000000006F39B000-memory.dmp

Filesize
5.7MB

Download
memory/2680-11-0x000000006EDF0000-0x000000006F39B000-memory.dmp

Filesize
5.7MB

Download
memory/2680-10-0x000000006EDF0000-0x000000006F39B000-memory.dmp

Filesize
5.7MB

Download
memory/2680-9-0x000000006EDF0000-0x000000006F39B000-memory.dmp

Filesize
5.7MB

Download
memory/2732-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2732-17-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2732-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2732-23-0x0000000000880000-0x0000000000B83000-memory.dmp

Filesize
3.0MB

Download
memory/2732-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2732-26-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads