xloader | b9f1b6b390e993702fc4638b3aa7bc0ff497cb7b1d7d48862fdf7c17ea2564e6

Analysis

max time kernel
147s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21/11/2024, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2575df47e8e09da1f99edde3c9533468c1c76e271e354323bb410aab1bd5f02f.exe
Size 244KB
Sample241121-ync54awkhw
SHA256 2575df47e8e09da1f99edde3c9533468c1c76e271e354323bb410aab1bd5f02f
MD5 ab56d27ab05f380a166ee2b9409a759b
SHA1 8fbda847f0969523042a9e9a0e1b2ce36e81d749
SHA512 6d824d2b1fc82298fe4b6d5bf735f3c88c272ed42134396a398481157812e1cd706ad915da4a7e64c7941e1898bbb0c8cf6c92602dd976618c270602e4a4a334
SSDEEP 6144:rGiK7P9Xjv4UPOth6tT+fzQrEdGUzlAsLRvDkE73Fb5iptZx9s:81XjO76Z+srE0URAkv7Gpt9s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xloader rbrt discovery loader rat

Malware Config

Extracted

Family

xloader

Version

Campaign

rbrt

Decoy

murphypowder.com
roof.rentals
portalcidadaniaitaliana.com
rosettbeloof.quest
topup.website
flinorease.com
snakncity.com
megasaldaolu2021.xyz
taichan.xyz
4x4education.com
metaversealive.com
xyzvoip.com
finansresultation.com
camperstales.com
shmckeji.com
cinzakother.quest
wdgjdhpg.com
scottsregalcleaners.com
azaz2.xyz
nate.sbs
techforphilly.com
362ralphdavidabernathy.com
venomfc.com
baxterhost.com
dskensho335.xyz
entrepreneurpublications.com
bitaddicts.net
fairfieldliaocheng-dcf.com
lovenowlivenowbook.com
dimension42.com
didfuid.com
threecommaslaw.com
bussyexpertise.com
noilavoratori.com
kenyajoyeria.com
firewall.email
sab-scribe.com
giftsscope.com
aemetaverse.com
cryptofax.net
theundyingpatriot.com
bluinfo.digital
bbqmagic-by-mike.com
sbcsummitbarcelona.com
blerv.com
bestofstmaarten.net
zoreshealthcare.com
herenhancements.com
vietthiphotography.com
explact.com
stingyh.com
fraudnft.com
abdomenpkluwk.xyz
highpacts.com
dealsforsuvsil.com
loveminidoll.com
stoneysbc.com
nault.biz
engineshouse.com
entirelybella.com
sixtablets.com
aj03yansinbiz.biz
ginkgobioworks.store
nutrijuicepr.com
12monthmillionairetraining.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/2972-12-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2972-15-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2976-22-0x00000000000C0000-0x00000000000E9000-memory.dmp	xloader

Executes dropped EXE 2 IoCs

pid	Process
2140	qmhzftyxd.exe
2972	qmhzftyxd.exe

Loads dropped DLL 2 IoCs

pid	Process
2376	2575df47e8e09da1f99edde3c9533468c1c76e271e354323bb410aab1bd5f02f.exe
2140	qmhzftyxd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2140 set thread context of 2972	2140	qmhzftyxd.exe	30
PID 2972 set thread context of 1204	2972	qmhzftyxd.exe	20
PID 2976 set thread context of 1204	2976	wininit.exe	20

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2575df47e8e09da1f99edde3c9533468c1c76e271e354323bb410aab1bd5f02f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qmhzftyxd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2972	qmhzftyxd.exe
2972	qmhzftyxd.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe
2976	wininit.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2972	qmhzftyxd.exe
2972	qmhzftyxd.exe
2972	qmhzftyxd.exe
2976	wininit.exe
2976	wininit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	qmhzftyxd.exe
Token: SeDebugPrivilege	2976	wininit.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2140	2376	2575df47e8e09da1f99edde3c9533468c1c76e271e354323bb410aab1bd5f02f.exe	29
PID 2376 wrote to memory of 2140	2376	2575df47e8e09da1f99edde3c9533468c1c76e271e354323bb410aab1bd5f02f.exe	29
PID 2376 wrote to memory of 2140	2376	2575df47e8e09da1f99edde3c9533468c1c76e271e354323bb410aab1bd5f02f.exe	29
PID 2376 wrote to memory of 2140	2376	2575df47e8e09da1f99edde3c9533468c1c76e271e354323bb410aab1bd5f02f.exe	29
PID 2140 wrote to memory of 2972	2140	qmhzftyxd.exe	30
PID 2140 wrote to memory of 2972	2140	qmhzftyxd.exe	30
PID 2140 wrote to memory of 2972	2140	qmhzftyxd.exe	30
PID 2140 wrote to memory of 2972	2140	qmhzftyxd.exe	30
PID 2140 wrote to memory of 2972	2140	qmhzftyxd.exe	30
PID 2140 wrote to memory of 2972	2140	qmhzftyxd.exe	30
PID 2140 wrote to memory of 2972	2140	qmhzftyxd.exe	30
PID 1204 wrote to memory of 2976	1204	Explorer.EXE	31
PID 1204 wrote to memory of 2976	1204	Explorer.EXE	31
PID 1204 wrote to memory of 2976	1204	Explorer.EXE	31
PID 1204 wrote to memory of 2976	1204	Explorer.EXE	31
PID 2976 wrote to memory of 3052	2976	wininit.exe	32
PID 2976 wrote to memory of 3052	2976	wininit.exe	32
PID 2976 wrote to memory of 3052	2976	wininit.exe	32
PID 2976 wrote to memory of 3052	2976	wininit.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\2575df47e8e09da1f99edde3c9533468c1c76e271e354323bb410aab1bd5f02f.exe
  "C:\Users\Admin\AppData\Local\Temp\2575df47e8e09da1f99edde3c9533468c1c76e271e354323bb410aab1bd5f02f.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Users\Admin\AppData\Local\Temp\qmhzftyxd.exe
    C:\Users\Admin\AppData\Local\Temp\qmhzftyxd.exe C:\Users\Admin\AppData\Local\Temp\glbqxojq
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\qmhzftyxd.exe
      C:\Users\Admin\AppData\Local\Temp\qmhzftyxd.exe C:\Users\Admin\AppData\Local\Temp\glbqxojq
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:2972
- C:\Windows\SysWOW64\wininit.exe
  "C:\Windows\SysWOW64\wininit.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\qmhzftyxd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

glbqxojq

Path C:\Users\Admin\AppData\Local\Temp\glbqxojq
Size 5KB
SHA256 b142c2076a679b9791de2c75d60d91bf512d4d9f9c8b0f899d987bcef5e3dafa
MD5 a05365ae52c2863aa47547876aa4ae23
SHA1 f071ee6d06061cdfd28b82ea612bf2b1bd8ecd5d
SHA512 d83ea7645c2d0b83a87d22d4b97347fd6712c09f6e7dcd1d5d51f02180a853b0344a33ae7555c9ebdeaf9d7c33537359cfe7fd914e4b66eaa5e3b8ff15febca5
SSDEEP 96:fXwv7sk5uFfWSBlvxdozvH9g6IDgZsQKYdO+RmdcbXpIc4PzGZOyTx+lZy:fXwjsSWfFBYvH94DQK+O+/3eixF
MD5 SHA1 SHA512 SSDEEP

Submit Download

y2c2ak3s9hlubx

Path C:\Users\Admin\AppData\Local\Temp\y2c2ak3s9hlubx
Size 213KB
SHA256 33e828e872dce5bafb41e635644ce13b17cba1ed2502412b6ca0a27b9367c44b
MD5 818c4223b9c6ff05e4a17af7ada350e7
SHA1 6cc9c97f1cdf5d7c256aa282bcc5d0b86062f4f6
SHA512 a1e967a070087c423238022ed745b73b09499c46da3d0c6bf4e404c67adbd8e68550a641d08eaff284d1300f86bb49bc7a9c3a6aa6cf68c0ddea2fddeb37584a
SSDEEP 6144:Lra93lZTWuIrPsLRvDkEdHBFICiptZxtD:L+93lZqPkvdHzmpttD
MD5 SHA1 SHA512 SSDEEP

Submit Download

qmhzftyxd.exe

Path \Users\Admin\AppData\Local\Temp\qmhzftyxd.exe
Size 4KB
SHA256 f7396efdcbc39e94a112ca8086d845b52ecbd9195516c9c9eff55491eee9f664
MD5 2281c1ed86f831c1fe3e0e9605f27b67
SHA1 492dce2fdc0859857277e4a4ac3b9bd6eb3cf966
SHA512 be68d2f3eaa905172ebfc325320d86143ea84f31791b348a9e3b7004d3b2dc4c499f7d5e0f19419ae2d7be0d9277ea69876784214480dca120240abbe60ddc36
SSDEEP 48:S+NGKNw3WqIvYoPPhCO3Rq7IOdCVTnmquFRuqS:ZdqIv3pRQIOUVkfx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1204-17-0x0000000004AA0000-0x0000000004BB2000-memory.dmp

Download

memory/1204-23-0x0000000004AA0000-0x0000000004BB2000-memory.dmp

Download

memory/2140-9-0x0000000000230000-0x0000000000232000-memory.dmp

Download

memory/2972-12-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2972-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2976-21-0x00000000007E0000-0x00000000007FA000-memory.dmp

Download

memory/2976-20-0x00000000007E0000-0x00000000007FA000-memory.dmp

Download

memory/2976-22-0x00000000000C0000-0x00000000000E9000-memory.dmp

Download