xloader | 86071c5800d553ea0cac697f9188a7b592aa9336bf59302545b14aed8b13ce11

General

Target

c8cb664fed47b0347a3e70df2d119327.exe
Size

218KB
MD5

c8cb664fed47b0347a3e70df2d119327
SHA1

26ebf61a4bd3cbef9e294dab68ee8459cfc456e4
SHA256

86071c5800d553ea0cac697f9188a7b592aa9336bf59302545b14aed8b13ce11
SHA512

8aeda509d035a7fe585c9c132d7dbdeb26a2fb64aae5769f275af5d7c79b1ff112a13f0e4f3d7c065ba1e3081f1048cdbb4608625e6552de3c6433aa7ed623e3

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

C2

http://www.856380692.xyz/nsag/

Decoy

usopencoverage.com

5bo5j.com

deliveryourvote.com

bestbuycarpethd.com

worldsourcecloud.com

glowtheblog.com

translations.tools

ithacapella.com

machinerysubway.com

aashlokhospitals.com

athara-kiano.com

anabittencourt.com

hakimkhawatmi.com

fashionwatchesstore.com

krishnagiri.info

tencenttexts.com

kodairo.com

ouitum.club

robertbeauford.net

polling.asia

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1984-5-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

c8cb664fed47b0347a3e70df2d119327.exe

pid process

1932 c8cb664fed47b0347a3e70df2d119327.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

c8cb664fed47b0347a3e70df2d119327.exe

description pid process target process

PID 1932 set thread context of 1984 1932 c8cb664fed47b0347a3e70df2d119327.exe c8cb664fed47b0347a3e70df2d119327.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 1932 set thread context of 1984	1932	c8cb664fed47b0347a3e70df2d119327.exe	c8cb664fed47b0347a3e70df2d119327.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

c8cb664fed47b0347a3e70df2d119327.exec8cb664fed47b0347a3e70df2d119327.exe

pid	process
1932	c8cb664fed47b0347a3e70df2d119327.exe
1932	c8cb664fed47b0347a3e70df2d119327.exe
1932	c8cb664fed47b0347a3e70df2d119327.exe
1932	c8cb664fed47b0347a3e70df2d119327.exe
1984	c8cb664fed47b0347a3e70df2d119327.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

c8cb664fed47b0347a3e70df2d119327.exe

pid process

1932 c8cb664fed47b0347a3e70df2d119327.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

c8cb664fed47b0347a3e70df2d119327.exe

description	pid	process	target process
PID 1932 wrote to memory of 1984	1932	c8cb664fed47b0347a3e70df2d119327.exe	c8cb664fed47b0347a3e70df2d119327.exe
PID 1932 wrote to memory of 1984	1932	c8cb664fed47b0347a3e70df2d119327.exe	c8cb664fed47b0347a3e70df2d119327.exe
PID 1932 wrote to memory of 1984	1932	c8cb664fed47b0347a3e70df2d119327.exe	c8cb664fed47b0347a3e70df2d119327.exe
PID 1932 wrote to memory of 1984	1932	c8cb664fed47b0347a3e70df2d119327.exe	c8cb664fed47b0347a3e70df2d119327.exe
PID 1932 wrote to memory of 1984	1932	c8cb664fed47b0347a3e70df2d119327.exe	c8cb664fed47b0347a3e70df2d119327.exe

C:\Users\Admin\AppData\Local\Temp\c8cb664fed47b0347a3e70df2d119327.exe
"C:\Users\Admin\AppData\Local\Temp\c8cb664fed47b0347a3e70df2d119327.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\AppData\Local\Temp\c8cb664fed47b0347a3e70df2d119327.exe
"C:\Users\Admin\AppData\Local\Temp\c8cb664fed47b0347a3e70df2d119327.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1984

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsc2CF.tmp\juydm.dll
MD5
d47373172c47da498eb7e24441e1b062

SHA1
41471188d2131a39c53fd75723ae6fc5dd9d78c3

SHA256
3756b2e35c8585028c7d7806507c60f6c58ff031235c2bf90e7078f5c22fbe15

SHA512
ec5ba1cd1602f7dd47c76f393acbfa82932ce81bdc459ad8640b2a9dc59325810b2b5ade27a55fdafae12ca9618fd0b1260d8a90bc8a91237a04999393c9bd66

Download Submit
memory/1932-2-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1984-4-0x000000000041D000-mapping.dmp

Download
memory/1984-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1984-6-0x0000000000840000-0x0000000000B43000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads