xloader | 9b38c45acf649b5db02318330583b66e8f70f637a54ef40db50afbef85a0cbb6

General

Target

MalwareBazaar.exe
Size

651KB
MD5

f41074eaa3e27940c9659ed547264c46
SHA1

b95ec335db31a00d2ec118afec3ff1a5885f93d4
SHA256

9b38c45acf649b5db02318330583b66e8f70f637a54ef40db50afbef85a0cbb6
SHA512

65c8b8f2fb091725bf5ce52777882f325ef08c72ae9693bebdf45e9d65b46c6b36f6b59f36ab3b5ffd1325ec43c52df49f5afd78597bda4fc664642d5609a498
SSDEEP

12288:2fBafvIKSe9qVlyQSRanh4cMVPzF62RIoDKbB38kjrhmlrFrncR:24f/R0VlyAh4DUoDKV38kjrUrF

Score

10^/10

xloader uem3 loader rat

Malware Config

Extracted

Family

xloader

Version

2.7

Campaign

uem3

Decoy

darwinschools.com

polytherm-vloerverwarming.com

sinibelanja.website

erasemy.info

domainedelapoujade.info

freidaperry.com

ensoustudio.com

xjyjjy.com

ezhuilike.com

equipoheza.com

vtsr-health.com

elanagro.online

savas-jewelry.com

hispahoo.com

nlsc.chat

wharxl.icu

funandfoodboat.com

usdtsearch.com

experimentguardian.xyz

bikeell.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/2556-12-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral1/memory/2556-16-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral1/memory/3008-23-0x00000000001C0000-0x00000000001EB000-memory.dmp	xloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Control Panel\International\Geo\Nation	MalwareBazaar.exe

Deletes itself 1 IoCs

pid	Process
1556	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2356 set thread context of 2556	2356	MalwareBazaar.exe	30
PID 2556 set thread context of 1268	2556	MalwareBazaar.exe	21
PID 3008 set thread context of 1268	3008	netsh.exe	21

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2556	MalwareBazaar.exe
2556	MalwareBazaar.exe
3008	netsh.exe
3008	netsh.exe
3008	netsh.exe
3008	netsh.exe
3008	netsh.exe
3008	netsh.exe
3008	netsh.exe
3008	netsh.exe
3008	netsh.exe
3008	netsh.exe
3008	netsh.exe
3008	netsh.exe
3008	netsh.exe
3008	netsh.exe
3008	netsh.exe
3008	netsh.exe
3008	netsh.exe
3008	netsh.exe
3008	netsh.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2556	MalwareBazaar.exe
2556	MalwareBazaar.exe
2556	MalwareBazaar.exe
3008	netsh.exe
3008	netsh.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	MalwareBazaar.exe
Token: SeDebugPrivilege	3008	netsh.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2556	2356	MalwareBazaar.exe	30
PID 2356 wrote to memory of 2556	2356	MalwareBazaar.exe	30
PID 2356 wrote to memory of 2556	2356	MalwareBazaar.exe	30
PID 2356 wrote to memory of 2556	2356	MalwareBazaar.exe	30
PID 2356 wrote to memory of 2556	2356	MalwareBazaar.exe	30
PID 2356 wrote to memory of 2556	2356	MalwareBazaar.exe	30
PID 2356 wrote to memory of 2556	2356	MalwareBazaar.exe	30
PID 1268 wrote to memory of 3008	1268	Explorer.EXE	31
PID 1268 wrote to memory of 3008	1268	Explorer.EXE	31
PID 1268 wrote to memory of 3008	1268	Explorer.EXE	31
PID 1268 wrote to memory of 3008	1268	Explorer.EXE	31
PID 3008 wrote to memory of 1556	3008	netsh.exe	32
PID 3008 wrote to memory of 1556	3008	netsh.exe	32
PID 3008 wrote to memory of 1556	3008	netsh.exe	32
PID 3008 wrote to memory of 1556	3008	netsh.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
  "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
    "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\SysWOW64\netsh.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
    3⤵
    - Deletes itself
    PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1268-26-0x0000000005050000-0x0000000005156000-memory.dmp

Filesize
1.0MB

Download
memory/1268-19-0x0000000005050000-0x0000000005156000-memory.dmp

Filesize
1.0MB

Download
memory/2356-13-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/2356-1-0x0000000000F60000-0x000000000100A000-memory.dmp

Filesize
680KB

Download
memory/2356-2-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/2356-3-0x00000000008E0000-0x00000000008EE000-memory.dmp

Filesize
56KB

Download
memory/2356-4-0x000000007490E000-0x000000007490F000-memory.dmp

Filesize
4KB

Download
memory/2356-5-0x0000000074900000-0x0000000074FEE000-memory.dmp

Filesize
6.9MB

Download
memory/2356-6-0x0000000005F10000-0x0000000005F78000-memory.dmp

Filesize
416KB

Download
memory/2356-7-0x0000000000950000-0x0000000000982000-memory.dmp

Filesize
200KB

Download
memory/2356-0-0x000000007490E000-0x000000007490F000-memory.dmp

Filesize
4KB

Download
memory/2556-8-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2556-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2556-14-0x0000000000990000-0x0000000000C93000-memory.dmp

Filesize
3.0MB

Download
memory/2556-17-0x0000000000180000-0x0000000000191000-memory.dmp

Filesize
68KB

Download
memory/2556-16-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2556-9-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2556-12-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3008-22-0x0000000001430000-0x000000000144B000-memory.dmp

Filesize
108KB

Download
memory/3008-20-0x0000000001430000-0x000000000144B000-memory.dmp

Filesize
108KB

Download
memory/3008-23-0x00000000001C0000-0x00000000001EB000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing