xloader | 24cec46977a0cbdcac2b936a8507377c764d082e071cdd14de8081f4d382cdf9

General

Target

PO.20586829.exe
Size

1.2MB
MD5

b45e34aecf9c73c7fb54edab05973e42
SHA1

41861a63a47b4d1a70d4d81dbde119bfb893abdc
SHA256

36a6dd99705baa431be4fa3b3d1223e540a171d419b79d0c466916269fb8608f
SHA512

d698e753d4d7a4141c6cfc6e7baa43e551a033cb0ddbc93a2cf229a450f24ef5bf106acff221241928b9612067a9e9eb178d722b21bed5ab9bb2ec54d35132f2
SSDEEP

24576:NyUDWIp7eS8sP60XYwxx3CZswC15rafWV/Nm/y12NhmI:A1ITV9XHSZCjaNyY/

Score

10^/10

xloader imta discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

imta

Decoy

conditions-credits.net

tamaracatharina-creative.com

semogalanggeng.com

lasvegascourier.com

loginkopi.com

easyspeak.life

alternacanarias.com

pasaeli.net

veragarcia.net

texassandhaulers.com

ihbonline.com

getawaytocornwall.com

vanilzamisturini.com

privatecine.com

picsag.com

rougeperiod.com

simplysouthdisinfecting.com

detectexperts.com

macdonald.delivery

fipcebpxx.icu

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/916-12-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/916-17-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/916-21-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/2876-28-0x0000000000970000-0x0000000000999000-memory.dmp	xloader

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4236 set thread context of 916	4236	PO.20586829.exe	99
PID 916 set thread context of 3476	916	PO.20586829.exe	56
PID 916 set thread context of 3476	916	PO.20586829.exe	56
PID 2876 set thread context of 3476	2876	explorer.exe	56

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO.20586829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
916	PO.20586829.exe
916	PO.20586829.exe
916	PO.20586829.exe
916	PO.20586829.exe
916	PO.20586829.exe
916	PO.20586829.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe
2876	explorer.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
916	PO.20586829.exe
916	PO.20586829.exe
916	PO.20586829.exe
916	PO.20586829.exe
2876	explorer.exe
2876	explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	PO.20586829.exe
Token: SeDebugPrivilege	2876	explorer.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 916	4236	PO.20586829.exe	99
PID 4236 wrote to memory of 916	4236	PO.20586829.exe	99
PID 4236 wrote to memory of 916	4236	PO.20586829.exe	99
PID 4236 wrote to memory of 916	4236	PO.20586829.exe	99
PID 4236 wrote to memory of 916	4236	PO.20586829.exe	99
PID 4236 wrote to memory of 916	4236	PO.20586829.exe	99
PID 3476 wrote to memory of 2876	3476	Explorer.EXE	101
PID 3476 wrote to memory of 2876	3476	Explorer.EXE	101
PID 3476 wrote to memory of 2876	3476	Explorer.EXE	101
PID 2876 wrote to memory of 4892	2876	explorer.exe	102
PID 2876 wrote to memory of 4892	2876	explorer.exe	102
PID 2876 wrote to memory of 4892	2876	explorer.exe	102

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Users\Admin\AppData\Local\Temp\PO.20586829.exe
  "C:\Users\Admin\AppData\Local\Temp\PO.20586829.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Users\Admin\AppData\Local\Temp\PO.20586829.exe
    "C:\Users\Admin\AppData\Local\Temp\PO.20586829.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:916
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:2412
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\PO.20586829.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/916-21-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/916-22-0x00000000015C0000-0x00000000015D0000-memory.dmp

Filesize
64KB

Download
memory/916-17-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/916-18-0x0000000001560000-0x0000000001570000-memory.dmp

Filesize
64KB

Download
memory/916-15-0x0000000001690000-0x00000000019DA000-memory.dmp

Filesize
3.3MB

Download
memory/2876-28-0x0000000000970000-0x0000000000999000-memory.dmp

Filesize
164KB

Download
memory/2876-27-0x0000000000A60000-0x0000000000E93000-memory.dmp

Filesize
4.2MB

Download
memory/2876-25-0x0000000000A60000-0x0000000000E93000-memory.dmp

Filesize
4.2MB

Download
memory/3476-24-0x0000000002800000-0x00000000028F1000-memory.dmp

Filesize
964KB

Download
memory/3476-19-0x0000000002800000-0x00000000028F1000-memory.dmp

Filesize
964KB

Download
memory/3476-35-0x0000000008D20000-0x0000000008E29000-memory.dmp

Filesize
1.0MB

Download
memory/3476-34-0x0000000008D20000-0x0000000008E29000-memory.dmp

Filesize
1.0MB

Download
memory/3476-32-0x0000000008D20000-0x0000000008E29000-memory.dmp

Filesize
1.0MB

Download
memory/3476-29-0x00000000089E0000-0x0000000008B61000-memory.dmp

Filesize
1.5MB

Download
memory/3476-23-0x00000000089E0000-0x0000000008B61000-memory.dmp

Filesize
1.5MB

Download
memory/4236-8-0x000000007518E000-0x000000007518F000-memory.dmp

Filesize
4KB

Download
memory/4236-6-0x0000000006770000-0x000000000678C000-memory.dmp

Filesize
112KB

Download
memory/4236-7-0x0000000006830000-0x00000000068CC000-memory.dmp

Filesize
624KB

Download
memory/4236-5-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/4236-4-0x00000000054F0000-0x00000000054FA000-memory.dmp

Filesize
40KB

Download
memory/4236-0-0x000000007518E000-0x000000007518F000-memory.dmp

Filesize
4KB

Download
memory/4236-3-0x0000000005500000-0x0000000005592000-memory.dmp

Filesize
584KB

Download
memory/4236-2-0x00000000059D0000-0x0000000005F74000-memory.dmp

Filesize
5.6MB

Download
memory/4236-1-0x00000000009C0000-0x0000000000B00000-memory.dmp

Filesize
1.2MB

Download
memory/4236-10-0x0000000008380000-0x000000000840A000-memory.dmp

Filesize
552KB

Download
memory/4236-14-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/4236-9-0x0000000075180000-0x0000000075930000-memory.dmp

Filesize
7.7MB

Download
memory/4236-11-0x000000000AAC0000-0x000000000AB14000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing