xloader | 366b61ad47c5472a3dd209905af47ec46613296e80ae0f3c0c48d11c84bbd1b6

General

Target

e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe
Size

369KB
MD5

e4e56f7fefe037591b5115092d6ee990
SHA1

b8d25f0e321c32e22af6df64d513c1d88e9f592c
SHA256

e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862
SHA512

c90369ee2284a101d964a850bca76f18608eed6c74c6f38f4e457006a227b9b504e22ebdddaed267e69293d98fe1e2d7c9f2e18fc213b1aeeb55243a4295dd02

Score

10^/10

xloader dhua loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

dhua

C2

http://www.segurosramosroman.com/dhua/

Decoy

ketostar.club

icanmakeyoufamous.com

claimygdejection.com

garlicinterestedparent.xyz

bits-clicks.com

030atk.xyz

ballwiegand.com

logs-illumidesk.com

785686.com

flnewsfeed.com

transporteshrj.net

agenciamundodigital.online

bowersllc.com

urchncenw.com

wuauwuaumx.com

littlesportsacademy.com

xn--m3chb3ax0abdta3fwhk.com

prmarketings.com

jiaozhanlianmeng.com

whenisthestore.space

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1284-56-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1284-57-0x000000000041D4E0-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe

pid process

1652 e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe

pid	process
1652	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe

description	pid	process	target process
PID 1652 set thread context of 1284	1652	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe

pid process

1284 e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe

pid	process
1284	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe

description	pid	process	target process
PID 1652 wrote to memory of 1284	1652	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe
PID 1652 wrote to memory of 1284	1652	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe
PID 1652 wrote to memory of 1284	1652	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe
PID 1652 wrote to memory of 1284	1652	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe
PID 1652 wrote to memory of 1284	1652	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe
PID 1652 wrote to memory of 1284	1652	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe
PID 1652 wrote to memory of 1284	1652	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe	e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe

C:\Users\Admin\AppData\Local\Temp\e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe
"C:\Users\Admin\AppData\Local\Temp\e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Local\Temp\e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe
"C:\Users\Admin\AppData\Local\Temp\e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1284

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nslC5DE.tmp\nbjkg.dll
MD5
ff488c7d8f8f03c34e67a7ac3ebeaafe

SHA1
bbc4aacac09047d12f6ea5b54a24255e9389ba0e

SHA256
b6f7a133237e590893ca7e6aceb76d96c8bfff8c767dcd4db53a57b366366dfa

SHA512
9955013d4f601507ab35453a5b38063cadd2f75946ed998169d7fc42fe133deed31a0927693c8f131161df5281e0a2499b2b37359f7662b3e948c2cf407e11f1

Download Submit
memory/1284-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1284-57-0x000000000041D4E0-mapping.dmp

Download
memory/1284-58-0x0000000000970000-0x0000000000C73000-memory.dmp

Filesize
3.0MB

Download
memory/1652-54-0x0000000074C71000-0x0000000074C73000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads