xloader | 3ff80b285092209abdbf24c2cba2edd443aacc91ad293d83cb63b12a9bf851d7

General

Target

Order 1429.exe
Size

414KB
MD5

b81fd6b263fc1617a21290a475e292e1
SHA1

789e25a0b2322b0e9721007786ec41316586a827
SHA256

720f9b3a1b8c9d8ea1eb23845f3fa508a9f5d06da878360ffd8ec608869c3398
SHA512

2131135ae25dd47153e39b6cd924737ad0e41f12dc40569c982660072635613f72e503420018c1a2649c37cff9dac35c1f249a243e5c6cdadc926160c440927d
SSDEEP

12288:CYSJoG/boVsdR0bmEKTteFgjeVwDnB6li:T21/0CYbmEKZfjhD

Score

10^/10

xloader snec discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

snec

Decoy

sacramentoscoop.com

auroraeqp.com

ontactfactory.com

abenakigroup.com

xander-tech.com

cocaineislegal.com

carbondouze.com

louisvilleestatelawyer.com

sundaytejero.quest

arti-faqs.com

thisandthat.store

biodyne-el-salvador.com

18504seheritageoakslane.com

mfialias.xyz

whitestoneclo.com

6288117.com

oficiosuy.com

autogift.xyz

wallbabyshell.com

chaletlabaie.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/2796-11-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2796-15-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2796-19-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2100 set thread context of 2796	2100	Order 1429.exe	32
PID 2796 set thread context of 1216	2796	Order 1429.exe	21
PID 2796 set thread context of 1216	2796	Order 1429.exe	21

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2616	2716	WerFault.exe	41

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Order 1429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2100	Order 1429.exe
2100	Order 1429.exe
2796	Order 1429.exe
2796	Order 1429.exe
2796	Order 1429.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2796	Order 1429.exe
2796	Order 1429.exe
2796	Order 1429.exe
2796	Order 1429.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	Order 1429.exe
Token: SeDebugPrivilege	2796	Order 1429.exe
Token: SeShutdownPrivilege	1216	Explorer.EXE
Token: SeShutdownPrivilege	1216	Explorer.EXE
Token: SeShutdownPrivilege	1216	Explorer.EXE

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2752	2100	Order 1429.exe	31
PID 2100 wrote to memory of 2752	2100	Order 1429.exe	31
PID 2100 wrote to memory of 2752	2100	Order 1429.exe	31
PID 2100 wrote to memory of 2752	2100	Order 1429.exe	31
PID 2100 wrote to memory of 2796	2100	Order 1429.exe	32
PID 2100 wrote to memory of 2796	2100	Order 1429.exe	32
PID 2100 wrote to memory of 2796	2100	Order 1429.exe	32
PID 2100 wrote to memory of 2796	2100	Order 1429.exe	32
PID 2100 wrote to memory of 2796	2100	Order 1429.exe	32
PID 2100 wrote to memory of 2796	2100	Order 1429.exe	32
PID 2100 wrote to memory of 2796	2100	Order 1429.exe	32
PID 1216 wrote to memory of 2716	1216	Explorer.EXE	41
PID 1216 wrote to memory of 2716	1216	Explorer.EXE	41
PID 1216 wrote to memory of 2716	1216	Explorer.EXE	41
PID 1216 wrote to memory of 2716	1216	Explorer.EXE	41
PID 1216 wrote to memory of 2716	1216	Explorer.EXE	41
PID 1216 wrote to memory of 2716	1216	Explorer.EXE	41
PID 1216 wrote to memory of 2716	1216	Explorer.EXE	41
PID 2716 wrote to memory of 2616	2716	msiexec.exe	42
PID 2716 wrote to memory of 2616	2716	msiexec.exe	42
PID 2716 wrote to memory of 2616	2716	msiexec.exe	42
PID 2716 wrote to memory of 2616	2716	msiexec.exe	42

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\Order 1429.exe
  "C:\Users\Admin\AppData\Local\Temp\Order 1429.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Users\Admin\AppData\Local\Temp\Order 1429.exe
    "C:\Users\Admin\AppData\Local\Temp\Order 1429.exe"
    3⤵
    PID:2752
- - C:\Users\Admin\AppData\Local\Temp\Order 1429.exe
    "C:\Users\Admin\AppData\Local\Temp\Order 1429.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2796
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2888
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2688
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2624
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:1164
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2168
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2784
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2852
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2776
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\SysWOW64\msiexec.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 268
    3⤵
    - Program crash
    PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-22-0x0000000005080000-0x0000000005183000-memory.dmp

Filesize
1.0MB

Download
memory/1216-17-0x0000000004140000-0x00000000041F9000-memory.dmp

Filesize
740KB

Download
memory/1216-21-0x0000000004140000-0x00000000041F9000-memory.dmp

Filesize
740KB

Download
memory/1216-29-0x0000000005080000-0x0000000005183000-memory.dmp

Filesize
1.0MB

Download
memory/2100-6-0x0000000007170000-0x00000000071C2000-memory.dmp

Filesize
328KB

Download
memory/2100-5-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/2100-4-0x000000007477E000-0x000000007477F000-memory.dmp

Filesize
4KB

Download
memory/2100-3-0x0000000000320000-0x000000000032E000-memory.dmp

Filesize
56KB

Download
memory/2100-12-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/2100-0-0x000000007477E000-0x000000007477F000-memory.dmp

Filesize
4KB

Download
memory/2100-2-0x0000000074770000-0x0000000074E5E000-memory.dmp

Filesize
6.9MB

Download
memory/2100-1-0x0000000000260000-0x00000000002CE000-memory.dmp

Filesize
440KB

Download
memory/2716-26-0x00000000007D0000-0x00000000007E4000-memory.dmp

Filesize
80KB

Download
memory/2716-24-0x00000000007D0000-0x00000000007E4000-memory.dmp

Filesize
80KB

Download
memory/2716-23-0x00000000007D0000-0x00000000007E4000-memory.dmp

Filesize
80KB

Download
memory/2796-13-0x00000000008D0000-0x0000000000BD3000-memory.dmp

Filesize
3.0MB

Download
memory/2796-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2796-16-0x0000000000230000-0x0000000000241000-memory.dmp

Filesize
68KB

Download
memory/2796-20-0x0000000000450000-0x0000000000461000-memory.dmp

Filesize
68KB

Download
memory/2796-19-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2796-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2796-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2796-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2796-7-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing