xloader | cebd1ec9af2345988d14f863738d097c2eb16096bb688acb89bd4167f702d9a6

General

Target

E-Invoice No 11073490.exe
Size

628KB
MD5

b6ff5bcf0679b7eb84b8c555c75e084b
SHA1

1d239a9a29f315832324795cb9c9a783bf420c26
SHA256

302f8d5292f11a4fb79650e41ee803bc2a0ff6a79666f39ad6033c4827eacba8
SHA512

147e3656519006209e6380f3a6e01f1011e4db49b4a0569465b1a29819ddfd1b7c3682ed56f82be0553bc7135cf351ad02ceea1376d57b3bdf9fc42e8d9ced60
SSDEEP

12288:C13Su/Dwg9Y0kuBXHyLA5ePOnhEWIlDr:CNScMWSOSRv

Score

10^/10

xloader 3voa8 discovery loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

3voa8

Decoy

artgamble.ltd

schoolq8.com

cartaporte.digital

vinetes.com

maxicashprogfd.xyz

motometics.com

uperiousa.com

chipwaterfrontresort.com

worldspeeddriven.com

thedefiantheathen.com

apurvamehrotra.com

dhaliwallabser.com

cheapestflightsindia.com

rs23.club

at247.tech

flypilotdigital.com

ruiheedu.xyz

lazarotools.com

heistick.xyz

precisalogistica.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/2664-12-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2664-15-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2668-22-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Deletes itself 1 IoCs

pid	Process
2680	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2872 set thread context of 2664	2872	E-Invoice No 11073490.exe	30
PID 2664 set thread context of 1352	2664	E-Invoice No 11073490.exe	21
PID 2668 set thread context of 1352	2668	cmmon32.exe	21

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E-Invoice No 11073490.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmmon32.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2872	E-Invoice No 11073490.exe
2664	E-Invoice No 11073490.exe
2664	E-Invoice No 11073490.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe
2668	cmmon32.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2664	E-Invoice No 11073490.exe
2664	E-Invoice No 11073490.exe
2664	E-Invoice No 11073490.exe
2668	cmmon32.exe
2668	cmmon32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	E-Invoice No 11073490.exe
Token: SeDebugPrivilege	2664	E-Invoice No 11073490.exe
Token: SeDebugPrivilege	2668	cmmon32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2664	2872	E-Invoice No 11073490.exe	30
PID 2872 wrote to memory of 2664	2872	E-Invoice No 11073490.exe	30
PID 2872 wrote to memory of 2664	2872	E-Invoice No 11073490.exe	30
PID 2872 wrote to memory of 2664	2872	E-Invoice No 11073490.exe	30
PID 2872 wrote to memory of 2664	2872	E-Invoice No 11073490.exe	30
PID 2872 wrote to memory of 2664	2872	E-Invoice No 11073490.exe	30
PID 2872 wrote to memory of 2664	2872	E-Invoice No 11073490.exe	30
PID 1352 wrote to memory of 2668	1352	Explorer.EXE	32
PID 1352 wrote to memory of 2668	1352	Explorer.EXE	32
PID 1352 wrote to memory of 2668	1352	Explorer.EXE	32
PID 1352 wrote to memory of 2668	1352	Explorer.EXE	32
PID 2668 wrote to memory of 2680	2668	cmmon32.exe	33
PID 2668 wrote to memory of 2680	2668	cmmon32.exe	33
PID 2668 wrote to memory of 2680	2668	cmmon32.exe	33
PID 2668 wrote to memory of 2680	2668	cmmon32.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Users\Admin\AppData\Local\Temp\E-Invoice No 11073490.exe
  "C:\Users\Admin\AppData\Local\Temp\E-Invoice No 11073490.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\E-Invoice No 11073490.exe
    "{path}"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:2664
- C:\Windows\SysWOW64\autofmt.exe
  "C:\Windows\SysWOW64\autofmt.exe"
  2⤵
  PID:2652
- C:\Windows\SysWOW64\cmmon32.exe
  "C:\Windows\SysWOW64\cmmon32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\E-Invoice No 11073490.exe"
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1352-17-0x0000000000010000-0x0000000000020000-memory.dmp

Filesize
64KB

Download
memory/1352-25-0x0000000002D10000-0x0000000002E10000-memory.dmp

Filesize
1024KB

Download
memory/1352-23-0x0000000006FF0000-0x000000000714A000-memory.dmp

Filesize
1.4MB

Download
memory/1352-18-0x0000000006FF0000-0x000000000714A000-memory.dmp

Filesize
1.4MB

Download
memory/2664-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2664-16-0x0000000000460000-0x0000000000471000-memory.dmp

Filesize
68KB

Download
memory/2664-15-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2664-13-0x0000000000700000-0x0000000000A03000-memory.dmp

Filesize
3.0MB

Download
memory/2664-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2664-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2664-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2668-21-0x0000000000690000-0x000000000069D000-memory.dmp

Filesize
52KB

Download
memory/2668-20-0x0000000000690000-0x000000000069D000-memory.dmp

Filesize
52KB

Download
memory/2668-22-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/2872-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

Filesize
4KB

Download
memory/2872-7-0x0000000000B90000-0x0000000000BC0000-memory.dmp

Filesize
192KB

Download
memory/2872-5-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2872-6-0x00000000052B0000-0x0000000005332000-memory.dmp

Filesize
520KB

Download
memory/2872-4-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

Filesize
4KB

Download
memory/2872-3-0x0000000000250000-0x000000000025A000-memory.dmp

Filesize
40KB

Download
memory/2872-19-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2872-2-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2872-1-0x0000000000FB0000-0x0000000001052000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing