xloader | 9b38c45acf649b5db02318330583b66e8f70f637a54ef40db50afbef85a0cbb6

General

Target

MalwareBazaar.exe
Size

651KB
MD5

f41074eaa3e27940c9659ed547264c46
SHA1

b95ec335db31a00d2ec118afec3ff1a5885f93d4
SHA256

9b38c45acf649b5db02318330583b66e8f70f637a54ef40db50afbef85a0cbb6
SHA512

65c8b8f2fb091725bf5ce52777882f325ef08c72ae9693bebdf45e9d65b46c6b36f6b59f36ab3b5ffd1325ec43c52df49f5afd78597bda4fc664642d5609a498
SSDEEP

12288:2fBafvIKSe9qVlyQSRanh4cMVPzF62RIoDKbB38kjrhmlrFrncR:24f/R0VlyAh4DUoDKV38kjrUrF

Score

10^/10

xloader uem3 loader rat

Malware Config

Extracted

Family

xloader

Version

2.7

Campaign

uem3

Decoy

darwinschools.com

polytherm-vloerverwarming.com

sinibelanja.website

erasemy.info

domainedelapoujade.info

freidaperry.com

ensoustudio.com

xjyjjy.com

ezhuilike.com

equipoheza.com

vtsr-health.com

elanagro.online

savas-jewelry.com

hispahoo.com

nlsc.chat

wharxl.icu

funandfoodboat.com

usdtsearch.com

experimentguardian.xyz

bikeell.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/692-12-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral2/memory/692-17-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral2/memory/4900-22-0x0000000000800000-0x000000000082B000-memory.dmp	xloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation	MalwareBazaar.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4728 set thread context of 692	4728	MalwareBazaar.exe	97
PID 692 set thread context of 3448	692	MalwareBazaar.exe	55
PID 4900 set thread context of 3448	4900	wscript.exe	55

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
692	MalwareBazaar.exe
692	MalwareBazaar.exe
692	MalwareBazaar.exe
692	MalwareBazaar.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe
4900	wscript.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
692	MalwareBazaar.exe
692	MalwareBazaar.exe
692	MalwareBazaar.exe
4900	wscript.exe
4900	wscript.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	692	MalwareBazaar.exe
Token: SeDebugPrivilege	4900	wscript.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3448	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 692	4728	MalwareBazaar.exe	97
PID 4728 wrote to memory of 692	4728	MalwareBazaar.exe	97
PID 4728 wrote to memory of 692	4728	MalwareBazaar.exe	97
PID 4728 wrote to memory of 692	4728	MalwareBazaar.exe	97
PID 4728 wrote to memory of 692	4728	MalwareBazaar.exe	97
PID 4728 wrote to memory of 692	4728	MalwareBazaar.exe	97
PID 3448 wrote to memory of 4900	3448	Explorer.EXE	99
PID 3448 wrote to memory of 4900	3448	Explorer.EXE	99
PID 3448 wrote to memory of 4900	3448	Explorer.EXE	99
PID 4900 wrote to memory of 1160	4900	wscript.exe	100
PID 4900 wrote to memory of 1160	4900	wscript.exe	100
PID 4900 wrote to memory of 1160	4900	wscript.exe	100

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
  "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
    "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:692
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2460
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\SysWOW64\wscript.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
    3⤵
    PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/692-12-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/692-17-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/692-18-0x00000000018C0000-0x00000000018D1000-memory.dmp

Filesize
68KB

Download
memory/692-15-0x00000000019D0000-0x0000000001D1A000-memory.dmp

Filesize
3.3MB

Download
memory/3448-29-0x000000000A600000-0x000000000A74B000-memory.dmp

Filesize
1.3MB

Download
memory/3448-26-0x000000000A600000-0x000000000A74B000-memory.dmp

Filesize
1.3MB

Download
memory/3448-25-0x0000000008D90000-0x0000000008E5A000-memory.dmp

Filesize
808KB

Download
memory/3448-24-0x000000000A600000-0x000000000A74B000-memory.dmp

Filesize
1.3MB

Download
memory/3448-19-0x0000000008D90000-0x0000000008E5A000-memory.dmp

Filesize
808KB

Download
memory/4728-6-0x0000000007A40000-0x0000000007A4E000-memory.dmp

Filesize
56KB

Download
memory/4728-0-0x000000007453E000-0x000000007453F000-memory.dmp

Filesize
4KB

Download
memory/4728-11-0x0000000006110000-0x0000000006142000-memory.dmp

Filesize
200KB

Download
memory/4728-9-0x0000000007AC0000-0x0000000007B28000-memory.dmp

Filesize
416KB

Download
memory/4728-14-0x0000000074530000-0x0000000074CE0000-memory.dmp

Filesize
7.7MB

Download
memory/4728-8-0x0000000074530000-0x0000000074CE0000-memory.dmp

Filesize
7.7MB

Download
memory/4728-7-0x000000007453E000-0x000000007453F000-memory.dmp

Filesize
4KB

Download
memory/4728-10-0x0000000007BD0000-0x0000000007C6C000-memory.dmp

Filesize
624KB

Download
memory/4728-5-0x0000000074530000-0x0000000074CE0000-memory.dmp

Filesize
7.7MB

Download
memory/4728-1-0x00000000003F0000-0x000000000049A000-memory.dmp

Filesize
680KB

Download
memory/4728-2-0x00000000053D0000-0x0000000005974000-memory.dmp

Filesize
5.6MB

Download
memory/4728-3-0x0000000004D40000-0x0000000004DD2000-memory.dmp

Filesize
584KB

Download
memory/4728-4-0x0000000004DF0000-0x0000000004DFA000-memory.dmp

Filesize
40KB

Download
memory/4900-22-0x0000000000800000-0x000000000082B000-memory.dmp

Filesize
172KB

Download
memory/4900-20-0x0000000000280000-0x00000000002A7000-memory.dmp

Filesize
156KB

Download
memory/4900-21-0x0000000000280000-0x00000000002A7000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing