xloader | 24cec46977a0cbdcac2b936a8507377c764d082e071cdd14de8081f4d382cdf9

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO.20586829.exe
Size

1.2MB
MD5

b45e34aecf9c73c7fb54edab05973e42
SHA1

41861a63a47b4d1a70d4d81dbde119bfb893abdc
SHA256

36a6dd99705baa431be4fa3b3d1223e540a171d419b79d0c466916269fb8608f
SHA512

d698e753d4d7a4141c6cfc6e7baa43e551a033cb0ddbc93a2cf229a450f24ef5bf106acff221241928b9612067a9e9eb178d722b21bed5ab9bb2ec54d35132f2
SSDEEP

24576:NyUDWIp7eS8sP60XYwxx3CZswC15rafWV/Nm/y12NhmI:A1ITV9XHSZCjaNyY/

Score

10^/10

xloader imta discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

imta

Decoy

conditions-credits.net

tamaracatharina-creative.com

semogalanggeng.com

lasvegascourier.com

loginkopi.com

easyspeak.life

alternacanarias.com

pasaeli.net

veragarcia.net

texassandhaulers.com

ihbonline.com

getawaytocornwall.com

vanilzamisturini.com

privatecine.com

picsag.com

rougeperiod.com

simplysouthdisinfecting.com

detectexperts.com

macdonald.delivery

fipcebpxx.icu

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2828-14-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2828-18-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2828-22-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2968-28-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Deletes itself 1 IoCs

pid	Process
2576	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1452 set thread context of 2828	1452	PO.20586829.exe	31
PID 2828 set thread context of 1204	2828	PO.20586829.exe	21
PID 2828 set thread context of 1204	2828	PO.20586829.exe	21
PID 2968 set thread context of 1204	2968	svchost.exe	21

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO.20586829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO.20586829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2828	PO.20586829.exe
2828	PO.20586829.exe
2828	PO.20586829.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe
2968	svchost.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2828	PO.20586829.exe
2828	PO.20586829.exe
2828	PO.20586829.exe
2828	PO.20586829.exe
2968	svchost.exe
2968	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2828	PO.20586829.exe
Token: SeDebugPrivilege	2968	svchost.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2828	1452	PO.20586829.exe	31
PID 1452 wrote to memory of 2828	1452	PO.20586829.exe	31
PID 1452 wrote to memory of 2828	1452	PO.20586829.exe	31
PID 1452 wrote to memory of 2828	1452	PO.20586829.exe	31
PID 1452 wrote to memory of 2828	1452	PO.20586829.exe	31
PID 1452 wrote to memory of 2828	1452	PO.20586829.exe	31
PID 1452 wrote to memory of 2828	1452	PO.20586829.exe	31
PID 2828 wrote to memory of 2968	2828	PO.20586829.exe	53
PID 2828 wrote to memory of 2968	2828	PO.20586829.exe	53
PID 2828 wrote to memory of 2968	2828	PO.20586829.exe	53
PID 2828 wrote to memory of 2968	2828	PO.20586829.exe	53
PID 2968 wrote to memory of 2576	2968	svchost.exe	54
PID 2968 wrote to memory of 2576	2968	svchost.exe	54
PID 2968 wrote to memory of 2576	2968	svchost.exe	54
PID 2968 wrote to memory of 2576	2968	svchost.exe	54

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\PO.20586829.exe
  "C:\Users\Admin\AppData\Local\Temp\PO.20586829.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Users\Admin\AppData\Local\Temp\PO.20586829.exe
    "C:\Users\Admin\AppData\Local\Temp\PO.20586829.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\SysWOW64\svchost.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c del "C:\Users\Admin\AppData\Local\Temp\PO.20586829.exe"
        5⤵
        Deletes itself
        System Location Discovery: System Language Discovery
        
        PID:2576
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2964
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2980
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2952
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2612
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2344
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2764
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2756
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2704
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2892
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2588
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2584
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2604
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2620
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2648
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2664
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2712
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2136
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2324
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2640
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2440
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-20-0x0000000005040000-0x000000000510B000-memory.dmp

Filesize
812KB

Download
memory/1204-29-0x00000000078C0000-0x0000000007A5B000-memory.dmp

Filesize
1.6MB

Download
memory/1204-25-0x0000000005040000-0x000000000510B000-memory.dmp

Filesize
812KB

Download
memory/1204-24-0x00000000078C0000-0x0000000007A5B000-memory.dmp

Filesize
1.6MB

Download
memory/1452-15-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/1452-4-0x000000007427E000-0x000000007427F000-memory.dmp

Filesize
4KB

Download
memory/1452-6-0x00000000050C0000-0x000000000514A000-memory.dmp

Filesize
552KB

Download
memory/1452-7-0x0000000000C00000-0x0000000000C54000-memory.dmp

Filesize
336KB

Download
memory/1452-1-0x00000000011B0000-0x00000000012F0000-memory.dmp

Filesize
1.2MB

Download
memory/1452-2-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/1452-5-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/1452-3-0x0000000000620000-0x000000000063C000-memory.dmp

Filesize
112KB

Download
memory/1452-0-0x000000007427E000-0x000000007427F000-memory.dmp

Filesize
4KB

Download
memory/2828-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2828-19-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2828-18-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2828-16-0x0000000000880000-0x0000000000B83000-memory.dmp

Filesize
3.0MB

Download
memory/2828-23-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/2828-22-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2828-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2828-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2828-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2968-27-0x0000000000930000-0x0000000000938000-memory.dmp

Filesize
32KB

Download
memory/2968-26-0x0000000000930000-0x0000000000938000-memory.dmp

Filesize
32KB

Download
memory/2968-28-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download