Malware Analysis Report

2024-11-30 22:14

Sample ID 241120-2r645azkgr
Target de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe
SHA256 de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038
Tags
xloader kqna discovery loader rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038

Threat Level: Known bad

The file de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe was found to be: Known bad.

Malicious Activity Summary

xloader kqna discovery loader rat

Xloader family

Xloader

Xloader payload

Loads dropped DLL

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Enumerates physical storage devices

System Location Discovery: System Language Discovery

NSIS installer

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-20 22:49

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-20 22:49

Reported

2024-11-20 22:52

Platform

win7-20240903-en

Max time kernel

119s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe"

Signatures

Xloader

loader xloader

Xloader family

xloader

Xloader payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2900 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe
PID 2900 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe
PID 2900 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe
PID 2900 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe
PID 2900 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe
PID 2900 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe
PID 2900 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe

Processes

C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe

"C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe"

C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe

"C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\nsd9FE8.tmp\oirygpbyia.dll

MD5 6d2a0ca8aac6594e4f037d3cecdace3b
SHA1 2fdc815752d2483ae536ed60dd2104b0e5cc2abd
SHA256 f7a3aa43e037f6b25c8070b3aaac9f0c5037abb1c4d01afd30a6f52f7c44f468
SHA512 cacc25100aedd926141416ef443dd40f03cb6b1512129bd707fc8ece1c9db2ad9a1de559e8cb3d29b569e2b1b843822f4ef681c4ea33bc5a6a290a3f17bdb7ee

memory/2900-8-0x0000000010009000-0x000000001000B000-memory.dmp

memory/2260-9-0x0000000000400000-0x0000000000429000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-20 22:49

Reported

2024-11-20 22:52

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe

"C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe"

C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe

"C:\Users\Admin\AppData\Local\Temp\de9346a05ac03dfd26e1d83046c07fb84540b26b6c4b6b8c06f29b5d34f21038.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3756 -ip 3756

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 960

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 96.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsy901B.tmp\oirygpbyia.dll

MD5 6d2a0ca8aac6594e4f037d3cecdace3b
SHA1 2fdc815752d2483ae536ed60dd2104b0e5cc2abd
SHA256 f7a3aa43e037f6b25c8070b3aaac9f0c5037abb1c4d01afd30a6f52f7c44f468
SHA512 cacc25100aedd926141416ef443dd40f03cb6b1512129bd707fc8ece1c9db2ad9a1de559e8cb3d29b569e2b1b843822f4ef681c4ea33bc5a6a290a3f17bdb7ee

memory/3756-7-0x0000000010009000-0x000000001000B000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-20 22:49

Reported

2024-11-20 22:52

Platform

win7-20240903-en

Max time kernel

146s

Max time network

118s

Command Line

C:\Windows\Explorer.EXE

Signatures

Xloader

loader xloader

Xloader family

xloader

Xloader payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 348 set thread context of 1372 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1372 set thread context of 1216 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Explorer.EXE
PID 2264 set thread context of 1216 N/A C:\Windows\SysWOW64\wuapp.exe C:\Windows\Explorer.EXE

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wuapp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\wuapp.exe N/A
N/A N/A C:\Windows\SysWOW64\wuapp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\wuapp.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2548 wrote to memory of 348 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2548 wrote to memory of 348 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2548 wrote to memory of 348 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2548 wrote to memory of 348 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2548 wrote to memory of 348 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2548 wrote to memory of 348 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2548 wrote to memory of 348 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 348 wrote to memory of 1372 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 348 wrote to memory of 1372 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 348 wrote to memory of 1372 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 348 wrote to memory of 1372 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 348 wrote to memory of 1372 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 348 wrote to memory of 1372 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 348 wrote to memory of 1372 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 348 wrote to memory of 1372 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 348 wrote to memory of 1372 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 348 wrote to memory of 1372 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1216 wrote to memory of 2264 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\wuapp.exe
PID 1216 wrote to memory of 2264 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\wuapp.exe
PID 1216 wrote to memory of 2264 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\wuapp.exe
PID 1216 wrote to memory of 2264 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\wuapp.exe
PID 1216 wrote to memory of 2264 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\wuapp.exe
PID 1216 wrote to memory of 2264 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\wuapp.exe
PID 1216 wrote to memory of 2264 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\wuapp.exe
PID 2264 wrote to memory of 2516 N/A C:\Windows\SysWOW64\wuapp.exe C:\Windows\SysWOW64\cmd.exe
PID 2264 wrote to memory of 2516 N/A C:\Windows\SysWOW64\wuapp.exe C:\Windows\SysWOW64\cmd.exe
PID 2264 wrote to memory of 2516 N/A C:\Windows\SysWOW64\wuapp.exe C:\Windows\SysWOW64\cmd.exe
PID 2264 wrote to memory of 2516 N/A C:\Windows\SysWOW64\wuapp.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\oirygpbyia.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\oirygpbyia.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\oirygpbyia.dll,#1

C:\Windows\SysWOW64\wuapp.exe

"C:\Windows\SysWOW64\wuapp.exe"

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Windows\SysWOW64\rundll32.exe"

Network

N/A

Files

memory/348-0-0x0000000010009000-0x000000001000B000-memory.dmp

memory/1372-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1372-2-0x0000000002260000-0x0000000002563000-memory.dmp

memory/1372-5-0x0000000000130000-0x0000000000141000-memory.dmp

memory/1372-4-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1216-6-0x0000000004E50000-0x0000000004F1D000-memory.dmp

memory/2264-8-0x00000000009E0000-0x00000000009EB000-memory.dmp

memory/2264-7-0x00000000009E0000-0x00000000009EB000-memory.dmp

memory/2264-9-0x00000000000D0000-0x00000000000F9000-memory.dmp

memory/1216-10-0x0000000004E50000-0x0000000004F1D000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-20 22:49

Reported

2024-11-20 22:52

Platform

win10v2004-20241007-en

Max time kernel

95s

Max time network

140s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\oirygpbyia.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1000 wrote to memory of 4216 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1000 wrote to memory of 4216 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1000 wrote to memory of 4216 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4216 wrote to memory of 4424 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4216 wrote to memory of 4424 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4216 wrote to memory of 4424 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4216 wrote to memory of 4424 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\oirygpbyia.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\oirygpbyia.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\oirygpbyia.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4216 -ip 4216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 656

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

memory/4216-0-0x0000000010009000-0x000000001000B000-memory.dmp