xloader | 3ff80b285092209abdbf24c2cba2edd443aacc91ad293d83cb63b12a9bf851d7

General

Target

Order 1429.exe
Size

414KB
MD5

b81fd6b263fc1617a21290a475e292e1
SHA1

789e25a0b2322b0e9721007786ec41316586a827
SHA256

720f9b3a1b8c9d8ea1eb23845f3fa508a9f5d06da878360ffd8ec608869c3398
SHA512

2131135ae25dd47153e39b6cd924737ad0e41f12dc40569c982660072635613f72e503420018c1a2649c37cff9dac35c1f249a243e5c6cdadc926160c440927d
SSDEEP

12288:CYSJoG/boVsdR0bmEKTteFgjeVwDnB6li:T21/0CYbmEKZfjhD

Score

10^/10

xloader snec discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

snec

Decoy

sacramentoscoop.com

auroraeqp.com

ontactfactory.com

abenakigroup.com

xander-tech.com

cocaineislegal.com

carbondouze.com

louisvilleestatelawyer.com

sundaytejero.quest

arti-faqs.com

thisandthat.store

biodyne-el-salvador.com

18504seheritageoakslane.com

mfialias.xyz

whitestoneclo.com

6288117.com

oficiosuy.com

autogift.xyz

wallbabyshell.com

chaletlabaie.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/920-11-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/920-16-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/920-20-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/3024-26-0x0000000000F30000-0x0000000000F59000-memory.dmp	xloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
43	3024	wscript.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4232 set thread context of 920	4232	Order 1429.exe	91
PID 920 set thread context of 3432	920	Order 1429.exe	56
PID 920 set thread context of 3432	920	Order 1429.exe	56
PID 3024 set thread context of 3432	3024	wscript.exe	56

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Order 1429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
920	Order 1429.exe
920	Order 1429.exe
920	Order 1429.exe
920	Order 1429.exe
920	Order 1429.exe
920	Order 1429.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe
3024	wscript.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
920	Order 1429.exe
920	Order 1429.exe
920	Order 1429.exe
920	Order 1429.exe
3024	wscript.exe
3024	wscript.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	920	Order 1429.exe
Token: SeDebugPrivilege	3024	wscript.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 920	4232	Order 1429.exe	91
PID 4232 wrote to memory of 920	4232	Order 1429.exe	91
PID 4232 wrote to memory of 920	4232	Order 1429.exe	91
PID 4232 wrote to memory of 920	4232	Order 1429.exe	91
PID 4232 wrote to memory of 920	4232	Order 1429.exe	91
PID 4232 wrote to memory of 920	4232	Order 1429.exe	91
PID 3432 wrote to memory of 3024	3432	Explorer.EXE	92
PID 3432 wrote to memory of 3024	3432	Explorer.EXE	92
PID 3432 wrote to memory of 3024	3432	Explorer.EXE	92
PID 3024 wrote to memory of 764	3024	wscript.exe	93
PID 3024 wrote to memory of 764	3024	wscript.exe	93
PID 3024 wrote to memory of 764	3024	wscript.exe	93

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Users\Admin\AppData\Local\Temp\Order 1429.exe
  "C:\Users\Admin\AppData\Local\Temp\Order 1429.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Users\Admin\AppData\Local\Temp\Order 1429.exe
    "C:\Users\Admin\AppData\Local\Temp\Order 1429.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:920
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\SysWOW64\wscript.exe"
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Order 1429.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/920-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-21-0x0000000001440000-0x0000000001451000-memory.dmp

Filesize
68KB

Download
memory/920-14-0x0000000000FE0000-0x000000000132A000-memory.dmp

Filesize
3.3MB

Download
memory/920-16-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/920-17-0x0000000000FA0000-0x0000000000FB1000-memory.dmp

Filesize
68KB

Download
memory/3024-25-0x00000000002B0000-0x00000000002D7000-memory.dmp

Filesize
156KB

Download
memory/3024-24-0x00000000002B0000-0x00000000002D7000-memory.dmp

Filesize
156KB

Download
memory/3024-26-0x0000000000F30000-0x0000000000F59000-memory.dmp

Filesize
164KB

Download
memory/3432-22-0x0000000007D00000-0x0000000007E98000-memory.dmp

Filesize
1.6MB

Download
memory/3432-18-0x00000000028B0000-0x0000000002987000-memory.dmp

Filesize
860KB

Download
memory/3432-33-0x0000000002AC0000-0x0000000002C21000-memory.dmp

Filesize
1.4MB

Download
memory/3432-32-0x0000000002AC0000-0x0000000002C21000-memory.dmp

Filesize
1.4MB

Download
memory/3432-30-0x0000000002AC0000-0x0000000002C21000-memory.dmp

Filesize
1.4MB

Download
memory/3432-27-0x0000000007D00000-0x0000000007E98000-memory.dmp

Filesize
1.6MB

Download
memory/3432-23-0x00000000028B0000-0x0000000002987000-memory.dmp

Filesize
860KB

Download
memory/4232-2-0x0000000008100000-0x00000000086A4000-memory.dmp

Filesize
5.6MB

Download
memory/4232-7-0x000000007454E000-0x000000007454F000-memory.dmp

Filesize
4KB

Download
memory/4232-10-0x000000000AAE0000-0x000000000AB32000-memory.dmp

Filesize
328KB

Download
memory/4232-1-0x0000000000D30000-0x0000000000D9E000-memory.dmp

Filesize
440KB

Download
memory/4232-3-0x0000000007C50000-0x0000000007CE2000-memory.dmp

Filesize
584KB

Download
memory/4232-0-0x000000007454E000-0x000000007454F000-memory.dmp

Filesize
4KB

Download
memory/4232-9-0x000000000A9F0000-0x000000000AA8C000-memory.dmp

Filesize
624KB

Download
memory/4232-8-0x0000000074540000-0x0000000074CF0000-memory.dmp

Filesize
7.7MB

Download
memory/4232-4-0x00000000030D0000-0x00000000030DA000-memory.dmp

Filesize
40KB

Download
memory/4232-5-0x0000000074540000-0x0000000074CF0000-memory.dmp

Filesize
7.7MB

Download
memory/4232-13-0x0000000074540000-0x0000000074CF0000-memory.dmp

Filesize
7.7MB

Download
memory/4232-6-0x0000000007D50000-0x0000000007D5E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing