xloader | 6a708470ee13d86b51352b69e755a9bcbd2730ecef34133dd1b5ed10b95f56a3

General

Target

3ee47ef2fed1383543fed2509ee9d533.exe
Size

201KB
MD5

3ee47ef2fed1383543fed2509ee9d533
SHA1

25bb17677a44eef76caab249e90188e2b6263b98
SHA256

6a708470ee13d86b51352b69e755a9bcbd2730ecef34133dd1b5ed10b95f56a3
SHA512

e42958a2b5d334fff9cbbb03259df1583be3bcb43807e786d6f896f1c78af22dfc8110687c4e6e5bca7a2a6a9a586af537568780b801258e9718d080c8507106

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.856380692.xyz/nsag/

Decoy

usopencoverage.com

5bo5j.com

deliveryourvote.com

bestbuycarpethd.com

worldsourcecloud.com

glowtheblog.com

translations.tools

ithacapella.com

machinerysubway.com

aashlokhospitals.com

athara-kiano.com

anabittencourt.com

hakimkhawatmi.com

fashionwatchesstore.com

krishnagiri.info

tencenttexts.com

kodairo.com

ouitum.club

robertbeauford.net

polling.asia

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3248-117-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

3ee47ef2fed1383543fed2509ee9d533.exe

pid process

416 3ee47ef2fed1383543fed2509ee9d533.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

3ee47ef2fed1383543fed2509ee9d533.exe

description pid process target process

PID 416 set thread context of 3248 416 3ee47ef2fed1383543fed2509ee9d533.exe 3ee47ef2fed1383543fed2509ee9d533.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3ee47ef2fed1383543fed2509ee9d533.exe

pid process

3248 3ee47ef2fed1383543fed2509ee9d533.exe
3248 3ee47ef2fed1383543fed2509ee9d533.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

3ee47ef2fed1383543fed2509ee9d533.exe

pid process

416 3ee47ef2fed1383543fed2509ee9d533.exe

pid	process
416	3ee47ef2fed1383543fed2509ee9d533.exe

description	pid	process	target process
PID 416 set thread context of 3248	416	3ee47ef2fed1383543fed2509ee9d533.exe	3ee47ef2fed1383543fed2509ee9d533.exe

pid	process
3248	3ee47ef2fed1383543fed2509ee9d533.exe
3248	3ee47ef2fed1383543fed2509ee9d533.exe

pid	process
416	3ee47ef2fed1383543fed2509ee9d533.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3ee47ef2fed1383543fed2509ee9d533.exe

description	pid	process	target process
PID 416 wrote to memory of 3248	416	3ee47ef2fed1383543fed2509ee9d533.exe	3ee47ef2fed1383543fed2509ee9d533.exe
PID 416 wrote to memory of 3248	416	3ee47ef2fed1383543fed2509ee9d533.exe	3ee47ef2fed1383543fed2509ee9d533.exe
PID 416 wrote to memory of 3248	416	3ee47ef2fed1383543fed2509ee9d533.exe	3ee47ef2fed1383543fed2509ee9d533.exe
PID 416 wrote to memory of 3248	416	3ee47ef2fed1383543fed2509ee9d533.exe	3ee47ef2fed1383543fed2509ee9d533.exe

C:\Users\Admin\AppData\Local\Temp\3ee47ef2fed1383543fed2509ee9d533.exe
"C:\Users\Admin\AppData\Local\Temp\3ee47ef2fed1383543fed2509ee9d533.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:416

C:\Users\Admin\AppData\Local\Temp\3ee47ef2fed1383543fed2509ee9d533.exe
"C:\Users\Admin\AppData\Local\Temp\3ee47ef2fed1383543fed2509ee9d533.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3248

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsz791E.tmp\utxxc4czqys.dll
MD5
a25fe018f6fb4fcd1134d4ffa75e9029

SHA1
e79647b873328ea7c0bb78002aebfcb28faac117

SHA256
3782ffc7a3c50c4953d328144e6e6c154eaf4986f2a4c7cb5781d64790c8cc9b

SHA512
8260e5008728bd161fc7f16923de5e266ffc5ac1d3758b667a275dfd5ac3f2fb713193b477b0565e5a9dfdf5b52428a9a6f33fb53a6572573bea637da772a15c

Download Submit
memory/416-116-0x0000000002C40000-0x0000000002C42000-memory.dmp

Filesize
8KB

Download
memory/3248-115-0x000000000041D000-mapping.dmp

Download
memory/3248-117-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3248-118-0x0000000000A40000-0x0000000000D60000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing