xloader | e0f6a62ae1dfbd451655ef46b2d3f3267edd04fab1b9683a7087cfb89d40545d

General

Target

Quotation.exe
Size

576KB
MD5

e1ebd51a52544a2ca2b2f8ac9a47a31c
SHA1

78c4acc43fedb4bf54220c7382b9a45c768aca3e
SHA256

f079d07d554c8fb387b3b5d040adb87504417def132f6e04578ecc0afd01eae6
SHA512

9bd32196620058a335ade12b0af4b94cddd37d2ed88004f1191e4f4fd7b805d6ebdad906c092c6d3d6e4859fa6ebd1902c0e9e15a29eeda7da1f1593797d7486
SSDEEP

12288:EzeaAF5gj58O4iwrhCB+jl9y1v2riq09qNZQNKF2AUjg7dA:E4gWO4vCBUg2rn091tA0gBA

Score

10^/10

xloader uidr loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

uidr

Decoy

dulichsongcham.com

cash-royal.com

geneseewildlifetrapping.com

9cc9x79m3y2.com

ntjjzx.com

joinglooko.com

upmchealhtrak.com

hookandcask.com

orca-web.com

ag3holdings.com

empoweredinvestmentstx.com

lustywall.com

rcpelaurentides.com

goyalcoorchidnirvanatwo.homes

iotajinn.com

littlemlive.com

hippocratesbio.com

ashleysema.design

175a45.xyz

bpocompaniesphilippines.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2612-11-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/2612-16-0x0000000000400000-0x0000000000428000-memory.dmp	xloader
behavioral1/memory/2604-21-0x0000000000080000-0x00000000000A8000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2896 cmd.exe

pid	process
2896	cmd.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Quotation.exeQuotation.exeipconfig.exe

description	pid	process	target process
PID 2440 set thread context of 2612	2440	Quotation.exe	Quotation.exe
PID 2612 set thread context of 1368	2612	Quotation.exe	Explorer.EXE
PID 2604 set thread context of 1368	2604	ipconfig.exe	Explorer.EXE

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exe

pid process

2604 ipconfig.exe

pid	process
2604	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

Quotation.exeipconfig.exe

pid	process
2612	Quotation.exe
2612	Quotation.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe
2604	ipconfig.exe

Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Quotation.exeipconfig.exe

pid process

2612 Quotation.exe
2612 Quotation.exe
2612 Quotation.exe
2604 ipconfig.exe
2604 ipconfig.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Quotation.exeipconfig.exe

description pid process

Token: SeDebugPrivilege 2612 Quotation.exe
Token: SeDebugPrivilege 2604 ipconfig.exe

description	pid	process
Token: SeDebugPrivilege	2612	Quotation.exe
Token: SeDebugPrivilege	2604	ipconfig.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Quotation.exeExplorer.EXEipconfig.exe

description	pid	process	target process
PID 2440 wrote to memory of 2612	2440	Quotation.exe	Quotation.exe
PID 2440 wrote to memory of 2612	2440	Quotation.exe	Quotation.exe
PID 2440 wrote to memory of 2612	2440	Quotation.exe	Quotation.exe
PID 2440 wrote to memory of 2612	2440	Quotation.exe	Quotation.exe
PID 2440 wrote to memory of 2612	2440	Quotation.exe	Quotation.exe
PID 2440 wrote to memory of 2612	2440	Quotation.exe	Quotation.exe
PID 2440 wrote to memory of 2612	2440	Quotation.exe	Quotation.exe
PID 1368 wrote to memory of 2604	1368	Explorer.EXE	ipconfig.exe
PID 1368 wrote to memory of 2604	1368	Explorer.EXE	ipconfig.exe
PID 1368 wrote to memory of 2604	1368	Explorer.EXE	ipconfig.exe
PID 1368 wrote to memory of 2604	1368	Explorer.EXE	ipconfig.exe
PID 2604 wrote to memory of 2896	2604	ipconfig.exe	cmd.exe
PID 2604 wrote to memory of 2896	2604	ipconfig.exe	cmd.exe
PID 2604 wrote to memory of 2896	2604	ipconfig.exe	cmd.exe
PID 2604 wrote to memory of 2896	2604	ipconfig.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2440

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\SysWOW64\ipconfig.exe"
2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
3⤵
- Deletes itself
PID:2896

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-17-0x00000000030E0000-0x00000000031E0000-memory.dmp

Filesize
1024KB

Download
memory/1368-24-0x00000000045A0000-0x0000000004673000-memory.dmp

Filesize
844KB

Download
memory/1368-18-0x00000000045A0000-0x0000000004673000-memory.dmp

Filesize
844KB

Download
memory/2440-5-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2440-3-0x0000000000880000-0x000000000088A000-memory.dmp

Filesize
40KB

Download
memory/2440-0-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

Filesize
4KB

Download
memory/2440-6-0x0000000004D00000-0x0000000004D5E000-memory.dmp

Filesize
376KB

Download
memory/2440-1-0x0000000000A00000-0x0000000000A96000-memory.dmp

Filesize
600KB

Download
memory/2440-4-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

Filesize
4KB

Download
memory/2440-12-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2440-2-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2604-21-0x0000000000080000-0x00000000000A8000-memory.dmp

Filesize
160KB

Download
memory/2604-20-0x0000000000C10000-0x0000000000C1A000-memory.dmp

Filesize
40KB

Download
memory/2604-19-0x0000000000C10000-0x0000000000C1A000-memory.dmp

Filesize
40KB

Download
memory/2612-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2612-14-0x0000000000AA0000-0x0000000000DA3000-memory.dmp

Filesize
3.0MB

Download
memory/2612-15-0x0000000000160000-0x0000000000170000-memory.dmp

Filesize
64KB

Download
memory/2612-16-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2612-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2612-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2612-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads