xloader | 3ef3975ab4bec816856ba408bf411af95a0be60796e7e80073a35e917fe70140

General

Target

Shipping Documents.exe
Size

691KB
MD5

57b685ccd486b411372b78b6e9705463
SHA1

7e4a97376af2c523b17c6bb5002dd9663cb74ba5
SHA256

4427d66aaf3710031c5545a66e249213b3196045c260bacc730f4298f32b9e39
SHA512

b9e1fd770f4a87f7f7a4d7d7cc9574ab0934f7d0baac9c985a018b9b3a9b28316733eed1e56c8fad6eff78cc6e5c0aa303d05ad1fee9fa7ca8405fbff085fa7e
SSDEEP

12288:aYn11R/5PQ6naUEQOYptwzC3EOO7QcUYfgzqnZuvkjg:nPFV7pgeEOO7Qufg+nZnj

Score

10^/10

xloader ouvk discovery execution loader rat

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

ouvk

Decoy

poker-star-top-casino.net

acinstallationamc.services

flashtte.com

le0hp8.xyz

christinasharpe.com

ligeria-production.net

bijiuche.com

cabolinansthingsandmore.com

rabbids-party-of-legends.com

governmentsscheme.com

weboughtavideostore.com

qrongsaid.com

audiodobyps5.com

laononggushi.com

piauipet.store

krav61.xyz

cownedes.com

okhuk.com

gsy56.com

fotografia360.agency

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader

Xloader payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/3068-21-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral1/memory/2892-26-0x0000000000080000-0x00000000000AB000-memory.dmp	xloader

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2604	powershell.exe

Deletes itself 1 IoCs

pid	Process
2580	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2536 set thread context of 3068	2536	Shipping Documents.exe	34
PID 3068 set thread context of 1256	3068	Shipping Documents.exe	21
PID 2892 set thread context of 1256	2892	raserver.exe	21

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Shipping Documents.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	raserver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3068	Shipping Documents.exe
2580	cmd.exe
2536	Shipping Documents.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2656	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3068	Shipping Documents.exe
3068	Shipping Documents.exe
2604	powershell.exe
2892	raserver.exe
2892	raserver.exe
2892	raserver.exe
2892	raserver.exe
2892	raserver.exe
2892	raserver.exe
2892	raserver.exe
2892	raserver.exe
2892	raserver.exe
2892	raserver.exe
2892	raserver.exe
2892	raserver.exe
2892	raserver.exe
2892	raserver.exe
2892	raserver.exe
2892	raserver.exe
2892	raserver.exe
2892	raserver.exe
2892	raserver.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
3068	Shipping Documents.exe
3068	Shipping Documents.exe
3068	Shipping Documents.exe
2892	raserver.exe
2892	raserver.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	Shipping Documents.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	2892	raserver.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2604	2536	Shipping Documents.exe	30
PID 2536 wrote to memory of 2604	2536	Shipping Documents.exe	30
PID 2536 wrote to memory of 2604	2536	Shipping Documents.exe	30
PID 2536 wrote to memory of 2604	2536	Shipping Documents.exe	30
PID 2536 wrote to memory of 2656	2536	Shipping Documents.exe	32
PID 2536 wrote to memory of 2656	2536	Shipping Documents.exe	32
PID 2536 wrote to memory of 2656	2536	Shipping Documents.exe	32
PID 2536 wrote to memory of 2656	2536	Shipping Documents.exe	32
PID 2536 wrote to memory of 3068	2536	Shipping Documents.exe	34
PID 2536 wrote to memory of 3068	2536	Shipping Documents.exe	34
PID 2536 wrote to memory of 3068	2536	Shipping Documents.exe	34
PID 2536 wrote to memory of 3068	2536	Shipping Documents.exe	34
PID 2536 wrote to memory of 3068	2536	Shipping Documents.exe	34
PID 2536 wrote to memory of 3068	2536	Shipping Documents.exe	34
PID 2536 wrote to memory of 3068	2536	Shipping Documents.exe	34
PID 1256 wrote to memory of 2892	1256	Explorer.EXE	35
PID 1256 wrote to memory of 2892	1256	Explorer.EXE	35
PID 1256 wrote to memory of 2892	1256	Explorer.EXE	35
PID 1256 wrote to memory of 2892	1256	Explorer.EXE	35
PID 2892 wrote to memory of 2580	2892	raserver.exe	36
PID 2892 wrote to memory of 2580	2892	raserver.exe	36
PID 2892 wrote to memory of 2580	2892	raserver.exe	36
PID 2892 wrote to memory of 2580	2892	raserver.exe	36

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe
  "C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AlYqySJhAwyNsl.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2604
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AlYqySJhAwyNsl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEB68.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2656
- - C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe
    "C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:3068
- C:\Windows\SysWOW64\raserver.exe
  "C:\Windows\SysWOW64\raserver.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEB68.tmp

Filesize
1KB

MD5
a3896c0e0a576442b2a352dbd1e8ed6f

SHA1
24aeacc3d92e5775ce68f935a2587593c7c677a7

SHA256
4ca5d01b7e6767b87b70cd7ebb943d72d359944359da64d0b2135833a114546d

SHA512
e12f7338bc6efb716e63ed7a1febf542509bfdc9e0db7ac73a4d02848282ab591eba7aa28ba053d653c5cce657871a89be99274c58f2b032f8c3a907b58bc8c9

Download Submit
memory/1256-24-0x0000000000010000-0x0000000000020000-memory.dmp

Filesize
64KB

Download
memory/2536-4-0x0000000073D1E000-0x0000000073D1F000-memory.dmp

Filesize
4KB

Download
memory/2536-13-0x0000000004CC0000-0x0000000004CF6000-memory.dmp

Filesize
216KB

Download
memory/2536-0-0x0000000073D1E000-0x0000000073D1F000-memory.dmp

Filesize
4KB

Download
memory/2536-5-0x0000000073D10000-0x00000000743FE000-memory.dmp

Filesize
6.9MB

Download
memory/2536-6-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/2536-7-0x0000000005E40000-0x0000000005EBC000-memory.dmp

Filesize
496KB

Download
memory/2536-2-0x0000000073D10000-0x00000000743FE000-memory.dmp

Filesize
6.9MB

Download
memory/2536-3-0x0000000000A90000-0x0000000000AAA000-memory.dmp

Filesize
104KB

Download
memory/2536-1-0x00000000012F0000-0x00000000013A4000-memory.dmp

Filesize
720KB

Download
memory/2536-22-0x0000000073D10000-0x00000000743FE000-memory.dmp

Filesize
6.9MB

Download
memory/2892-25-0x0000000000B90000-0x0000000000BAC000-memory.dmp

Filesize
112KB

Download
memory/2892-26-0x0000000000080000-0x00000000000AB000-memory.dmp

Filesize
172KB

Download
memory/3068-18-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3068-16-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3068-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3068-21-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads