xloader | e6e9f774351440aef9b0b309282155ad0258f6e97da820170384454711e4bef8

General

Target

f7ab1c6e6623676d14665c84fdc9aee4.exe
Size

217KB
MD5

f7ab1c6e6623676d14665c84fdc9aee4
SHA1

6d5b39ada2ead78c8977cb917cfee6e83180116f
SHA256

e6e9f774351440aef9b0b309282155ad0258f6e97da820170384454711e4bef8
SHA512

71239d2d161879d13053f3512a57a84fd9a86e907874075a7f6f143e6b96b0f64c5e933a4fb15d7deb4c3723ca8d1856723b7d8efa82ced17879f7f30c6483cf

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

C2

http://www.856380692.xyz/nsag/

Decoy

usopencoverage.com

5bo5j.com

deliveryourvote.com

bestbuycarpethd.com

worldsourcecloud.com

glowtheblog.com

translations.tools

ithacapella.com

machinerysubway.com

aashlokhospitals.com

athara-kiano.com

anabittencourt.com

hakimkhawatmi.com

fashionwatchesstore.com

krishnagiri.info

tencenttexts.com

kodairo.com

ouitum.club

robertbeauford.net

polling.asia

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3252-4-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

f7ab1c6e6623676d14665c84fdc9aee4.exe

pid process

412 f7ab1c6e6623676d14665c84fdc9aee4.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

f7ab1c6e6623676d14665c84fdc9aee4.exe

description pid process target process

PID 412 set thread context of 3252 412 f7ab1c6e6623676d14665c84fdc9aee4.exe f7ab1c6e6623676d14665c84fdc9aee4.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 412 set thread context of 3252	412	f7ab1c6e6623676d14665c84fdc9aee4.exe	f7ab1c6e6623676d14665c84fdc9aee4.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

f7ab1c6e6623676d14665c84fdc9aee4.exef7ab1c6e6623676d14665c84fdc9aee4.exe

pid	process
412	f7ab1c6e6623676d14665c84fdc9aee4.exe
412	f7ab1c6e6623676d14665c84fdc9aee4.exe
412	f7ab1c6e6623676d14665c84fdc9aee4.exe
412	f7ab1c6e6623676d14665c84fdc9aee4.exe
412	f7ab1c6e6623676d14665c84fdc9aee4.exe
412	f7ab1c6e6623676d14665c84fdc9aee4.exe
412	f7ab1c6e6623676d14665c84fdc9aee4.exe
412	f7ab1c6e6623676d14665c84fdc9aee4.exe
3252	f7ab1c6e6623676d14665c84fdc9aee4.exe
3252	f7ab1c6e6623676d14665c84fdc9aee4.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

f7ab1c6e6623676d14665c84fdc9aee4.exe

pid process

412 f7ab1c6e6623676d14665c84fdc9aee4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f7ab1c6e6623676d14665c84fdc9aee4.exe

description	pid	process	target process
PID 412 wrote to memory of 3252	412	f7ab1c6e6623676d14665c84fdc9aee4.exe	f7ab1c6e6623676d14665c84fdc9aee4.exe
PID 412 wrote to memory of 3252	412	f7ab1c6e6623676d14665c84fdc9aee4.exe	f7ab1c6e6623676d14665c84fdc9aee4.exe
PID 412 wrote to memory of 3252	412	f7ab1c6e6623676d14665c84fdc9aee4.exe	f7ab1c6e6623676d14665c84fdc9aee4.exe
PID 412 wrote to memory of 3252	412	f7ab1c6e6623676d14665c84fdc9aee4.exe	f7ab1c6e6623676d14665c84fdc9aee4.exe

C:\Users\Admin\AppData\Local\Temp\f7ab1c6e6623676d14665c84fdc9aee4.exe
"C:\Users\Admin\AppData\Local\Temp\f7ab1c6e6623676d14665c84fdc9aee4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:412

C:\Users\Admin\AppData\Local\Temp\f7ab1c6e6623676d14665c84fdc9aee4.exe
"C:\Users\Admin\AppData\Local\Temp\f7ab1c6e6623676d14665c84fdc9aee4.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3252

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsu795D.tmp\93ni8zi9fd1f.dll
MD5
6bb21314f484e79d6d6e4b2329ee68ef

SHA1
e988cdc158cf6eb71e19afc946812d77f02ff370

SHA256
c7f2500459484d1df8d6a2c6a391d39ba79c1343412eb0231d036fb036b0368a

SHA512
ea1e7341484cb41d8081a6d018fb1f383727613cf228aa9fabb32405c8c8159d68e8572e5e0eb85b40de6538c540d837ee7b96c886739b449dd1b93c75ce1c09

Download Submit
memory/3252-3-0x000000000041D000-mapping.dmp

Download
memory/3252-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3252-5-0x0000000000A20000-0x0000000000D40000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads