xloader | dd26890c428fbd34566c4d8e7f77dfd4fc8a7fbadc90c051e643f41b8776519d

General

Target

577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe
Size

773KB
MD5

03de471c92b69d97ceec18cf3c4b5745
SHA1

4e9dc0753d89f8a40f8e2c7734f6389851bec7f6
SHA256

577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb
SHA512

f66f3044c31e0834511dbf04df95835dce8d5562989ec3939c75c9b625af05b8cdbe71f11147a18e72ceec5f8916edd044f91e0c57b06cdf77287f9a7d153dc2
SSDEEP

12288:3zvu+M1iheIgKP429mBbX5TyadWOkhff0rUyOnHl2KzhV+ZtkrbhxM9JbrWBFw2J:e2MldWLhff0aF2AH+cM99riN//

Score

10^/10

xloader x8be discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

x8be

Decoy

happybms.com

noemibuchi.com

rubyonthegodesigns.com

geylaniiskele.com

forsaerp.com

fexatech.com

jiggymaxxdesigns.com

ravexim3.com

dandeliondips.com

championzclub.com

jimmeh-art.com

convection-furacious.com

waknerd.com

ivcmath.com

stilebios.com

svetlanakobaliya.com

soldhomeforfullprice.com

lowebeholdtwelvefold.com

tracigo.com

crowdstorage.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2068-20-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1244 set thread context of 2068	1244	577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2068	577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe
1244	577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2612	1244	577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe	31
PID 1244 wrote to memory of 2612	1244	577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe	31
PID 1244 wrote to memory of 2612	1244	577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe	31
PID 1244 wrote to memory of 2612	1244	577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe	31
PID 1244 wrote to memory of 2068	1244	577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe	33
PID 1244 wrote to memory of 2068	1244	577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe	33
PID 1244 wrote to memory of 2068	1244	577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe	33
PID 1244 wrote to memory of 2068	1244	577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe	33
PID 1244 wrote to memory of 2068	1244	577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe	33
PID 1244 wrote to memory of 2068	1244	577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe	33
PID 1244 wrote to memory of 2068	1244	577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe	33

C:\Users\Admin\AppData\Local\Temp\577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe
"C:\Users\Admin\AppData\Local\Temp\577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bTHirXJjtxWaSQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp76F4.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe
  "C:\Users\Admin\AppData\Local\Temp\577827e2f48011f122d58835338951e8fcef29ab3f17d11062008dd78ab3a6cb.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp76F4.tmp

Filesize
1KB

MD5
3c1bbc85a4d1989654c1f9b90f959527

SHA1
38970be293ff5ea9c46b133c2e92cf106b9edfdf

SHA256
c3c07f13d7d9aa813fd19d7ea1ff5dd11f83b9400f7a6df35e19f036ebc40d8f

SHA512
2ccfa63066a21e76ae7d01b0a7f32388112a7cf147b608036188f5b083858d13fbf365debcd457564757dbb4033ef066933d2cc16d22bd4bbd874110f5c97499

Download Submit
memory/1244-4-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/1244-22-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/1244-3-0x000000000A480000-0x000000000A496000-memory.dmp

Filesize
88KB

Download
memory/1244-0-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/1244-5-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/1244-6-0x0000000005720000-0x00000000057BE000-memory.dmp

Filesize
632KB

Download
memory/1244-2-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/1244-1-0x0000000000330000-0x00000000003F8000-memory.dmp

Filesize
800KB

Download
memory/1244-7-0x0000000005B70000-0x0000000005BD4000-memory.dmp

Filesize
400KB

Download
memory/2068-13-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2068-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2068-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2068-21-0x0000000000A60000-0x0000000000D63000-memory.dmp

Filesize
3.0MB

Download
memory/2068-20-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2068-23-0x0000000000A60000-0x0000000000D63000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads