xloader | 222c8a0ce49171c3bb93631e7001bb152ad05fa4ba13437a173f1d0dd9fd0a4e

General

Target

RFQ54488203expediere_doc202177,pdf.exe
Size

299KB
MD5

486990b975aa0c60bdbc054ae6a2b3cd
SHA1

9806f58700e62c3de83536edb99fd66aa1c01d82
SHA256

222c8a0ce49171c3bb93631e7001bb152ad05fa4ba13437a173f1d0dd9fd0a4e
SHA512

d1091d97ac39c381086424a55867eed1029879aa91174222fc94cd0f255bc4e5d877fb6b52761528fd9e08821150b4df6f8bd8bd846ade9f0e5b520cde8554a9

Score

10^/10

xloader dhua loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

dhua

C2

http://www.segurosramosroman.com/dhua/

Decoy

ketostar.club

icanmakeyoufamous.com

claimygdejection.com

garlicinterestedparent.xyz

bits-clicks.com

030atk.xyz

ballwiegand.com

logs-illumidesk.com

785686.com

flnewsfeed.com

transporteshrj.net

agenciamundodigital.online

bowersllc.com

urchncenw.com

wuauwuaumx.com

littlesportsacademy.com

xn--m3chb3ax0abdta3fwhk.com

prmarketings.com

jiaozhanlianmeng.com

whenisthestore.space

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/384-115-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/384-116-0x000000000041D4E0-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

RFQ54488203expediere_doc202177,pdf.exe

pid process

904 RFQ54488203expediere_doc202177,pdf.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ54488203expediere_doc202177,pdf.exe

description pid process target process

PID 904 set thread context of 384 904 RFQ54488203expediere_doc202177,pdf.exe RFQ54488203expediere_doc202177,pdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RFQ54488203expediere_doc202177,pdf.exe

pid process

384 RFQ54488203expediere_doc202177,pdf.exe
384 RFQ54488203expediere_doc202177,pdf.exe

pid	process
904	RFQ54488203expediere_doc202177,pdf.exe

description	pid	process	target process
PID 904 set thread context of 384	904	RFQ54488203expediere_doc202177,pdf.exe	RFQ54488203expediere_doc202177,pdf.exe

pid	process
384	RFQ54488203expediere_doc202177,pdf.exe
384	RFQ54488203expediere_doc202177,pdf.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

RFQ54488203expediere_doc202177,pdf.exe

description	pid	process	target process
PID 904 wrote to memory of 384	904	RFQ54488203expediere_doc202177,pdf.exe	RFQ54488203expediere_doc202177,pdf.exe
PID 904 wrote to memory of 384	904	RFQ54488203expediere_doc202177,pdf.exe	RFQ54488203expediere_doc202177,pdf.exe
PID 904 wrote to memory of 384	904	RFQ54488203expediere_doc202177,pdf.exe	RFQ54488203expediere_doc202177,pdf.exe
PID 904 wrote to memory of 384	904	RFQ54488203expediere_doc202177,pdf.exe	RFQ54488203expediere_doc202177,pdf.exe
PID 904 wrote to memory of 384	904	RFQ54488203expediere_doc202177,pdf.exe	RFQ54488203expediere_doc202177,pdf.exe
PID 904 wrote to memory of 384	904	RFQ54488203expediere_doc202177,pdf.exe	RFQ54488203expediere_doc202177,pdf.exe

C:\Users\Admin\AppData\Local\Temp\RFQ54488203expediere_doc202177,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ54488203expediere_doc202177,pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:904

C:\Users\Admin\AppData\Local\Temp\RFQ54488203expediere_doc202177,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ54488203expediere_doc202177,pdf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:384

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsp969E.tmp\rwajh.dll
MD5
186d1d11820a440827ee416f70cc3f82

SHA1
137c092412fdd2d5b37cf6de89b4fb6fb68b097e

SHA256
3b813b0b19bd0f10547adc1245760f1f75ffc386f8ba9459b9d1d7521f7fe9a7

SHA512
7ad80068effd64824378ece834556e02faf6ad8af6a104ad5b5331de171461526a081fd5516f5d93d536805678ef931f0cde7c201862ee3f0a5ecd8a35861380

Download Submit
memory/384-115-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/384-116-0x000000000041D4E0-mapping.dmp

Download
memory/384-117-0x00000000009C0000-0x0000000000CE0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing