xloader | 5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706

General

Target

5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe
Size

219KB
MD5

5972ee4c522e2f18ff3102bb94444db5
SHA1

1439b110cd660222879bc7ff4716c1498a87f5c4
SHA256

5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706
SHA512

2b621f69ceb36cfe9f3fe68a2df2a5685c0c2b73699ff8cc06b24b510714d43bd267876760fa3768effed7539b61d4957ad660ce135b3261e83984e9ea8584ea

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.christopherngai.com/boit/

Decoy

kuhanticiy.site

rosecoline.com

lapertuna.com

fedeschwalb.com

cvstore1.com

761215.com

secretivecriticaldeeply.net

2503322.com

zhongda8.com

xsynergysip.com

hologramhell.com

argetench.com

rsmenterprises.net

sunsasound.com

thietbinuoc.com

proofreadingbypaulina.com

apnidukan.life

petsmartapp.com

raumluftraum.com

whitehorseavon.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1612-63-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe

pid process

756 5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe

description	pid	process	target process
PID 756 set thread context of 1612	756	5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe	5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe

pid	process
756	5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe
756	5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe
756	5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe
756	5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe
1612	5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe

pid process

756 5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe

description	pid	process	target process
PID 756 wrote to memory of 1612	756	5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe	5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe
PID 756 wrote to memory of 1612	756	5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe	5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe
PID 756 wrote to memory of 1612	756	5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe	5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe
PID 756 wrote to memory of 1612	756	5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe	5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe
PID 756 wrote to memory of 1612	756	5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe	5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe

C:\Users\Admin\AppData\Local\Temp\5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe
"C:\Users\Admin\AppData\Local\Temp\5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:756

C:\Users\Admin\AppData\Local\Temp\5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe
"C:\Users\Admin\AppData\Local\Temp\5fc118f68d961f9bd3c38d15bd6c0e6eed0b66c12412c344d766460b48355706.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1612

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd95AC.tmp\l6q09tpj2i.dll
MD5
a11ccf3cb9aac8360e27c60f4b8d9a2b

SHA1
1e0cee6a0282a754f7c59ddd05c78fd5aaac14a7

SHA256
3fc0051d7156d6c97ef54e91dac26bb39a96a74149fe53583adfd4d7619fd9b0

SHA512
7d680f10512a5c5d8e76b2c39168added0ab408c506dff90a9fc6ada61aef17f2694f029fb2df9b09d2106b45e380fa73234fabc0f52d5542a3d1c043e94f0c7

Download Submit
memory/756-60-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1612-62-0x000000000041D060-mapping.dmp

Download
memory/1612-63-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1612-64-0x0000000000950000-0x0000000000C53000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads