xloader | 9b8e02c9169932cb809300c4dff5afc240aba4d5a87264f0f7123314345c6248

General

Target

4e38f139a12a838dbde332c9d6285d2f.exe
Size

218KB
MD5

4e38f139a12a838dbde332c9d6285d2f
SHA1

d9870967a42b9f754faf19c729fe5cfe1429556f
SHA256

9b8e02c9169932cb809300c4dff5afc240aba4d5a87264f0f7123314345c6248
SHA512

ab87a3301375a7ad63db3bc9d1904118fc82a206eeeef86596e760dcd7d7c09cd93fe672fe11f0a47110d413ad7fefc26819dde9aee672edd482a87e5104bb73

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

C2

http://www.fountainhead410.com/jzvu/

Decoy

rezabird.com

amthebomb.com

cqfsc.net

scottgesslerdesign.com

australianhempco.com

digitalkn.com

theoneandonlytattoostudio.com

chaing-list.xyz

technicaljanu.com

tigerkid.net

mels.ink

adassadelacruz.com

deep-freezers.xyz

kundanbangles.com

88840678.com

xiaonaphotography.online

john-heer-stuttgart.com

gumrukihalesi.com

veekasdoshi.com

purathanam.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3012-4-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

4e38f139a12a838dbde332c9d6285d2f.exe

pid process

4652 4e38f139a12a838dbde332c9d6285d2f.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

4e38f139a12a838dbde332c9d6285d2f.exe

description pid process target process

PID 4652 set thread context of 3012 4652 4e38f139a12a838dbde332c9d6285d2f.exe 4e38f139a12a838dbde332c9d6285d2f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 4652 set thread context of 3012	4652	4e38f139a12a838dbde332c9d6285d2f.exe	4e38f139a12a838dbde332c9d6285d2f.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

4e38f139a12a838dbde332c9d6285d2f.exe4e38f139a12a838dbde332c9d6285d2f.exe

pid	process
4652	4e38f139a12a838dbde332c9d6285d2f.exe
4652	4e38f139a12a838dbde332c9d6285d2f.exe
4652	4e38f139a12a838dbde332c9d6285d2f.exe
4652	4e38f139a12a838dbde332c9d6285d2f.exe
4652	4e38f139a12a838dbde332c9d6285d2f.exe
4652	4e38f139a12a838dbde332c9d6285d2f.exe
4652	4e38f139a12a838dbde332c9d6285d2f.exe
4652	4e38f139a12a838dbde332c9d6285d2f.exe
3012	4e38f139a12a838dbde332c9d6285d2f.exe
3012	4e38f139a12a838dbde332c9d6285d2f.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

4e38f139a12a838dbde332c9d6285d2f.exe

pid process

4652 4e38f139a12a838dbde332c9d6285d2f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

4e38f139a12a838dbde332c9d6285d2f.exe

description	pid	process	target process
PID 4652 wrote to memory of 3012	4652	4e38f139a12a838dbde332c9d6285d2f.exe	4e38f139a12a838dbde332c9d6285d2f.exe
PID 4652 wrote to memory of 3012	4652	4e38f139a12a838dbde332c9d6285d2f.exe	4e38f139a12a838dbde332c9d6285d2f.exe
PID 4652 wrote to memory of 3012	4652	4e38f139a12a838dbde332c9d6285d2f.exe	4e38f139a12a838dbde332c9d6285d2f.exe
PID 4652 wrote to memory of 3012	4652	4e38f139a12a838dbde332c9d6285d2f.exe	4e38f139a12a838dbde332c9d6285d2f.exe

C:\Users\Admin\AppData\Local\Temp\4e38f139a12a838dbde332c9d6285d2f.exe
"C:\Users\Admin\AppData\Local\Temp\4e38f139a12a838dbde332c9d6285d2f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4652

C:\Users\Admin\AppData\Local\Temp\4e38f139a12a838dbde332c9d6285d2f.exe
"C:\Users\Admin\AppData\Local\Temp\4e38f139a12a838dbde332c9d6285d2f.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3012

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd4FCC.tmp\cx67q960gnfsak.dll
MD5
7c62e61b4ef935588ae9f1ac06f25aef

SHA1
bebd69699282e251febeea424c26184987fe4b0f

SHA256
8044fa7a693f7616b70f2bb1b99c7247f6b5daf9792d0916431ca72afca6806d

SHA512
dc55efba66637352aa1cc723e40386af58fbce9e4d2b43f49f739b234484af277c666fdb44e53f80f6653b21b361dbd1fe999ce60a385ec019b0317b67dc6a07

Download Submit
memory/3012-3-0x000000000041D100-mapping.dmp

Download
memory/3012-4-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3012-5-0x0000000000B20000-0x0000000000E40000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads