xloader | 2eb57ff3dfafc142e693dd878044f38cb02090cbef35246b2525d19abf0fbaf5

General

Target

1edfdb02b75931f824ee82640283671be10398b4.exe
Size

205KB
MD5

c30480523e2f0d910f78aea742cb9c3a
SHA1

1edfdb02b75931f824ee82640283671be10398b4
SHA256

2eb57ff3dfafc142e693dd878044f38cb02090cbef35246b2525d19abf0fbaf5
SHA512

ad5289ced6ec2757af225d7830cab9684ee6e2a00a2088626d29b1d100920fde69062932d351d9d4a946ca269f4ba89800ad2ba02c198940204f94584c63b94d

Score

10^/10

xloader loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.onyxcomputing.com/u8nw/

Decoy

constructionjadams.com

organicwellnessfarm.com

beautiful.tours

medvows.com

foxparanormal.com

fsmxmc.com

graniterealestategroup.net

qgi1.com

astrologicsolutions.com

rafbar.com

bastiontools.net

emotist.com

stacyleets.com

bloodtypealpha.com

healtybenenfitsplus.com

vavadadoa3.com

chefbenhk.com

dotgz.com

xn--z4qm188e645c.com

ethyi.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1220-117-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

1edfdb02b75931f824ee82640283671be10398b4.exe

pid process

3176 1edfdb02b75931f824ee82640283671be10398b4.exe

pid	process
3176	1edfdb02b75931f824ee82640283671be10398b4.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1edfdb02b75931f824ee82640283671be10398b4.exe

description	pid	process	target process
PID 3176 set thread context of 1220	3176	1edfdb02b75931f824ee82640283671be10398b4.exe	1edfdb02b75931f824ee82640283671be10398b4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1edfdb02b75931f824ee82640283671be10398b4.exe

pid process

1220 1edfdb02b75931f824ee82640283671be10398b4.exe
1220 1edfdb02b75931f824ee82640283671be10398b4.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

1edfdb02b75931f824ee82640283671be10398b4.exe

pid process

3176 1edfdb02b75931f824ee82640283671be10398b4.exe

pid	process
1220	1edfdb02b75931f824ee82640283671be10398b4.exe
1220	1edfdb02b75931f824ee82640283671be10398b4.exe

pid	process
3176	1edfdb02b75931f824ee82640283671be10398b4.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1edfdb02b75931f824ee82640283671be10398b4.exe

description	pid	process	target process
PID 3176 wrote to memory of 1220	3176	1edfdb02b75931f824ee82640283671be10398b4.exe	1edfdb02b75931f824ee82640283671be10398b4.exe
PID 3176 wrote to memory of 1220	3176	1edfdb02b75931f824ee82640283671be10398b4.exe	1edfdb02b75931f824ee82640283671be10398b4.exe
PID 3176 wrote to memory of 1220	3176	1edfdb02b75931f824ee82640283671be10398b4.exe	1edfdb02b75931f824ee82640283671be10398b4.exe
PID 3176 wrote to memory of 1220	3176	1edfdb02b75931f824ee82640283671be10398b4.exe	1edfdb02b75931f824ee82640283671be10398b4.exe

C:\Users\Admin\AppData\Local\Temp\1edfdb02b75931f824ee82640283671be10398b4.exe
"C:\Users\Admin\AppData\Local\Temp\1edfdb02b75931f824ee82640283671be10398b4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3176

C:\Users\Admin\AppData\Local\Temp\1edfdb02b75931f824ee82640283671be10398b4.exe
"C:\Users\Admin\AppData\Local\Temp\1edfdb02b75931f824ee82640283671be10398b4.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1220

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsxD74.tmp\dpra.dll
MD5
3feb8ed49836d35cbab9f2bb9dfaa428

SHA1
c2a418b93c0bb81ef62267bfed522250321791db

SHA256
92dab948f60160d5aba56d2c8c30d83b0a7247ec4e3a8cccc74adb6ef799f051

SHA512
fe765d282f7fa205a0661f62c6023d71d08818b400c2a20fd868b8c66fdbe5a62218b570292423c1dc02c8881610f3dde55ae7dbbd86b7df3ae2e46d447ed732

Download Submit
memory/1220-116-0x000000000041D0C0-mapping.dmp

Download
memory/1220-117-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1220-118-0x0000000000A30000-0x0000000000D50000-memory.dmp

Filesize
3.1MB

Download
memory/3176-115-0x00000000028B0000-0x00000000028B2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads