xloader | 34066150ffa7efa505b8d2246925cd8a32f83b9609438ae76aa27cef7388054d

General

Target

7b6e0668659b20f30bdf81025247a199.exe
Size

218KB
MD5

7b6e0668659b20f30bdf81025247a199
SHA1

27f1e8665c5423b43a5ad11a7d3762c539fbef9c
SHA256

34066150ffa7efa505b8d2246925cd8a32f83b9609438ae76aa27cef7388054d
SHA512

62b1bb025e1ba2969dbed85c6c96ef4f0c78fc9c58db4442c441f70a6587e9e3421717c67c12ffd95f0e7347b941fd389cadc97be4cac612e02f71388e2e05b4

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

C2

http://www.856380692.xyz/nsag/

Decoy

usopencoverage.com

5bo5j.com

deliveryourvote.com

bestbuycarpethd.com

worldsourcecloud.com

glowtheblog.com

translations.tools

ithacapella.com

machinerysubway.com

aashlokhospitals.com

athara-kiano.com

anabittencourt.com

hakimkhawatmi.com

fashionwatchesstore.com

krishnagiri.info

tencenttexts.com

kodairo.com

ouitum.club

robertbeauford.net

polling.asia

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1992-5-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

7b6e0668659b20f30bdf81025247a199.exe

pid process

1932 7b6e0668659b20f30bdf81025247a199.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

7b6e0668659b20f30bdf81025247a199.exe

description pid process target process

PID 1932 set thread context of 1992 1932 7b6e0668659b20f30bdf81025247a199.exe 7b6e0668659b20f30bdf81025247a199.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 1932 set thread context of 1992	1932	7b6e0668659b20f30bdf81025247a199.exe	7b6e0668659b20f30bdf81025247a199.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

7b6e0668659b20f30bdf81025247a199.exe7b6e0668659b20f30bdf81025247a199.exe

pid	process
1932	7b6e0668659b20f30bdf81025247a199.exe
1932	7b6e0668659b20f30bdf81025247a199.exe
1932	7b6e0668659b20f30bdf81025247a199.exe
1932	7b6e0668659b20f30bdf81025247a199.exe
1992	7b6e0668659b20f30bdf81025247a199.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

7b6e0668659b20f30bdf81025247a199.exe

pid process

1932 7b6e0668659b20f30bdf81025247a199.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

7b6e0668659b20f30bdf81025247a199.exe

description	pid	process	target process
PID 1932 wrote to memory of 1992	1932	7b6e0668659b20f30bdf81025247a199.exe	7b6e0668659b20f30bdf81025247a199.exe
PID 1932 wrote to memory of 1992	1932	7b6e0668659b20f30bdf81025247a199.exe	7b6e0668659b20f30bdf81025247a199.exe
PID 1932 wrote to memory of 1992	1932	7b6e0668659b20f30bdf81025247a199.exe	7b6e0668659b20f30bdf81025247a199.exe
PID 1932 wrote to memory of 1992	1932	7b6e0668659b20f30bdf81025247a199.exe	7b6e0668659b20f30bdf81025247a199.exe
PID 1932 wrote to memory of 1992	1932	7b6e0668659b20f30bdf81025247a199.exe	7b6e0668659b20f30bdf81025247a199.exe

C:\Users\Admin\AppData\Local\Temp\7b6e0668659b20f30bdf81025247a199.exe
"C:\Users\Admin\AppData\Local\Temp\7b6e0668659b20f30bdf81025247a199.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\AppData\Local\Temp\7b6e0668659b20f30bdf81025247a199.exe
"C:\Users\Admin\AppData\Local\Temp\7b6e0668659b20f30bdf81025247a199.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nss37B.tmp\0ps12v89.dll

MD5
4ad8a4a30a1cc665078b16cebcc04ae3

SHA1
fa62f869142deb3ab2c83e2d80be9030363aa443

SHA256
d080eadcd3766d785ab5cdebc15e67f4b18027241aa724b5581b68d26229cb06

SHA512
4b0bd177f13eae8f2762ca291ecfc9a4b95bc22795920259e8646d9912d547a3994525762bcfb66036e4a1cab155b32d694ef43ec6c4a3999b40f05a82711da0

Download Submit
memory/1932-2-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1992-4-0x000000000041D000-mapping.dmp

Download
memory/1992-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1992-6-0x0000000000830000-0x0000000000B33000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads