xloader | b5e3426a888ddb5751f9802093f1bd10ec696b2994bee03b99b7ba2b4f21a57d

General

Target

91523f8d438585534d9466432cc4665d.exe
Size

201KB
MD5

91523f8d438585534d9466432cc4665d
SHA1

e34b69f0ded056eca7dd43b8f5be2edf7198c211
SHA256

b5e3426a888ddb5751f9802093f1bd10ec696b2994bee03b99b7ba2b4f21a57d
SHA512

e8035c994acd9e46738b87eae25248df1548f8782d7475b4e9d362b68362ce62962780e46be0e054b9645d1be4e1eea8c93096f8e90bcb179040b5014eeec77b

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.simplyhealrhcareplans.com/sqra/

Decoy

edwardjonescredticard.com

muzhskoy-eskort.site

home-sou.com

entohops.com

orchidandiris.com

kellnetworks.com

shopthen2.site

jimmysga.com

carobbella.com

fenuadiscovery.com

huongdandidong.com

greenesgoodies.com

socialunified.com

azure-vs-google.cloud

bardototonho.com

anadelalastra.art

godseyepiece.com

18082020.com

3559044.com

hvacservicecoldwater.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2000-63-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

91523f8d438585534d9466432cc4665d.exe

pid process

1596 91523f8d438585534d9466432cc4665d.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

91523f8d438585534d9466432cc4665d.exe

description pid process target process

PID 1596 set thread context of 2000 1596 91523f8d438585534d9466432cc4665d.exe 91523f8d438585534d9466432cc4665d.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

91523f8d438585534d9466432cc4665d.exe

pid process

2000 91523f8d438585534d9466432cc4665d.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

91523f8d438585534d9466432cc4665d.exe

pid process

1596 91523f8d438585534d9466432cc4665d.exe

pid	process
1596	91523f8d438585534d9466432cc4665d.exe

description	pid	process	target process
PID 1596 set thread context of 2000	1596	91523f8d438585534d9466432cc4665d.exe	91523f8d438585534d9466432cc4665d.exe

pid	process
2000	91523f8d438585534d9466432cc4665d.exe

pid	process
1596	91523f8d438585534d9466432cc4665d.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

91523f8d438585534d9466432cc4665d.exe

description	pid	process	target process
PID 1596 wrote to memory of 2000	1596	91523f8d438585534d9466432cc4665d.exe	91523f8d438585534d9466432cc4665d.exe
PID 1596 wrote to memory of 2000	1596	91523f8d438585534d9466432cc4665d.exe	91523f8d438585534d9466432cc4665d.exe
PID 1596 wrote to memory of 2000	1596	91523f8d438585534d9466432cc4665d.exe	91523f8d438585534d9466432cc4665d.exe
PID 1596 wrote to memory of 2000	1596	91523f8d438585534d9466432cc4665d.exe	91523f8d438585534d9466432cc4665d.exe
PID 1596 wrote to memory of 2000	1596	91523f8d438585534d9466432cc4665d.exe	91523f8d438585534d9466432cc4665d.exe

C:\Users\Admin\AppData\Local\Temp\91523f8d438585534d9466432cc4665d.exe
"C:\Users\Admin\AppData\Local\Temp\91523f8d438585534d9466432cc4665d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1596

C:\Users\Admin\AppData\Local\Temp\91523f8d438585534d9466432cc4665d.exe
"C:\Users\Admin\AppData\Local\Temp\91523f8d438585534d9466432cc4665d.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2000

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nss7791.tmp\9a5t.dll
MD5
e5a5e61ad269d94aa1f74f929f76addc

SHA1
41a4642319054581903776cd0fe5ac282ec6fc8a

SHA256
3e39c71277fd492f9e995a5913176bebd8f78b9cff306a9ce6e5c8dba7600015

SHA512
81f2245b1c4c465acfc6ba70a81ba840a04b65d87f7c88ac44cbe816e8be546fd7b4a56d5a162da5f4bc991436d95a0d0ab289856f1f3d2472c690ebdda07fa9

Download Submit
memory/1596-59-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/1596-62-0x0000000001C90000-0x0000000001C92000-memory.dmp

Filesize
8KB

Download
memory/2000-61-0x000000000041D080-mapping.dmp

Download
memory/2000-64-0x0000000000890000-0x0000000000B93000-memory.dmp

Filesize
3.0MB

Download
memory/2000-63-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing