xloader | ded8c07fb7142ba39946dd3aaac2ec104a19cd919f4e7a7eda7781db6e3816ee

General

Target

REVISE 50% OCTA INVOICE.exe
Size

257KB
MD5

093048c24b9994fef2130cd8457e7a4b
SHA1

f3c31eefe661b1febc80c0865af8f4fd1385ac7f
SHA256

0e803b7715385244cae58772b5b0da43b7cca6a97c5ffd182081eca8676ff5d7
SHA512

e95142b25ae3078c642df183213ed06ccb0b5b65c4b25c3844803258d8b149c3570fdd00a25b539199f44ad10877c37139e430febe304ad6860511c379d4a2ba
SSDEEP

6144:rGiHxY9gDrwfI4pppl819WDk4UQ/FENd0AVT/+yIXg:LxYMrwfI8l819Z4UsFEf0CL+Zw

Score

10^/10

xloader e8ia discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

e8ia

Decoy

le-hameau-enchanteur.com

quantumsystem-au.club

engravedeeply.com

yesrecompensas.lat

cavallitowerofficials.com

800seaspray.com

skifun-jetski.com

thouartafoot.com

nft2dollar.com

petrestore.online

cjcutthecord2.com

tippimccullough.com

gadget198.xyz

djmiriam.com

bitbasepay.com

cukierniawz.com

mcclureic.xyz

inthekitchenshakinandbakin.com

busy-clicks.com

melaniemorris.online

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2732-9-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2732-11-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2732-14-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2912-22-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Deletes itself 1 IoCs

pid	Process
2720	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2756	REVISE 50% OCTA INVOICE.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2756 set thread context of 2732	2756	REVISE 50% OCTA INVOICE.exe	30
PID 2732 set thread context of 1204	2732	REVISE 50% OCTA INVOICE.exe	21
PID 2732 set thread context of 1204	2732	REVISE 50% OCTA INVOICE.exe	21
PID 2912 set thread context of 1204	2912	wlanext.exe	21

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REVISE 50% OCTA INVOICE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlanext.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2732	REVISE 50% OCTA INVOICE.exe
2732	REVISE 50% OCTA INVOICE.exe
2732	REVISE 50% OCTA INVOICE.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe
2912	wlanext.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
2732	REVISE 50% OCTA INVOICE.exe
2732	REVISE 50% OCTA INVOICE.exe
2732	REVISE 50% OCTA INVOICE.exe
2732	REVISE 50% OCTA INVOICE.exe
2912	wlanext.exe
2912	wlanext.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	REVISE 50% OCTA INVOICE.exe
Token: SeDebugPrivilege	2912	wlanext.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2732	2756	REVISE 50% OCTA INVOICE.exe	30
PID 2756 wrote to memory of 2732	2756	REVISE 50% OCTA INVOICE.exe	30
PID 2756 wrote to memory of 2732	2756	REVISE 50% OCTA INVOICE.exe	30
PID 2756 wrote to memory of 2732	2756	REVISE 50% OCTA INVOICE.exe	30
PID 2756 wrote to memory of 2732	2756	REVISE 50% OCTA INVOICE.exe	30
PID 2756 wrote to memory of 2732	2756	REVISE 50% OCTA INVOICE.exe	30
PID 2756 wrote to memory of 2732	2756	REVISE 50% OCTA INVOICE.exe	30
PID 1204 wrote to memory of 2912	1204	Explorer.EXE	31
PID 1204 wrote to memory of 2912	1204	Explorer.EXE	31
PID 1204 wrote to memory of 2912	1204	Explorer.EXE	31
PID 1204 wrote to memory of 2912	1204	Explorer.EXE	31
PID 2912 wrote to memory of 2720	2912	wlanext.exe	32
PID 2912 wrote to memory of 2720	2912	wlanext.exe	32
PID 2912 wrote to memory of 2720	2912	wlanext.exe	32
PID 2912 wrote to memory of 2720	2912	wlanext.exe	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\REVISE 50% OCTA INVOICE.exe
  "C:\Users\Admin\AppData\Local\Temp\REVISE 50% OCTA INVOICE.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\REVISE 50% OCTA INVOICE.exe
    "C:\Users\Admin\AppData\Local\Temp\REVISE 50% OCTA INVOICE.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2732
- C:\Windows\SysWOW64\wlanext.exe
  "C:\Windows\SysWOW64\wlanext.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\REVISE 50% OCTA INVOICE.exe"
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nso7051.tmp\pqcs.dll

Filesize
33KB

MD5
f2828be237823a888b96c7d265c0ec05

SHA1
bf3b7ee29a6ff865fd6c17fd449cca42e4c6bc74

SHA256
61591ac877c329a2b715066f957ea19c164bc78c1ffaf59c769462a689f3b139

SHA512
2b94e24a27f47cac7494cc9a876e7f27a0f9a53b1a2be5e9f46efa94abd29287edae2de1784e387f28483dad99d7af12ac61e0fe450e1b00a1c5c1cdf32185c5

Download Submit
memory/1204-12-0x00000000078E0000-0x0000000007A4B000-memory.dmp

Filesize
1.4MB

Download
memory/1204-16-0x0000000007320000-0x000000000745B000-memory.dmp

Filesize
1.2MB

Download
memory/1204-23-0x0000000007320000-0x000000000745B000-memory.dmp

Filesize
1.2MB

Download
memory/2732-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2732-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2732-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2756-7-0x0000000010009000-0x000000001000B000-memory.dmp

Filesize
8KB

Download
memory/2912-21-0x00000000005F0000-0x0000000000606000-memory.dmp

Filesize
88KB

Download
memory/2912-19-0x00000000005F0000-0x0000000000606000-memory.dmp

Filesize
88KB

Download
memory/2912-22-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing