xloader | f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175

General

Target

f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe
Size

440KB
MD5

f51da2ac8cdfc1ff41921f0fceee4514
SHA1

f910ed6637480ff6930df72d9258029641a186ba
SHA256

f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175
SHA512

830f6fadf25b3b839d648a71e82eb3fb37c0e5376d5ce76044a39321ab54f356cec4f9a8ef08f01ebe2d86b6e6643a24a591b680ab2f88c29ecb8e43e837ed46

Score

10^/10

xloader noha loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

noha

C2

http://www.mglracing.com/noha/

Decoy

iphone13promax.support

trailer-racks.xyz

overseaspoolservice.com

r2d2u.com

dawajeju.com

nextgenproxyvote.com

xn--vhqp8mm8dbtz.group

commonsenserisk.com

cmcqgxtyd.com

data2form.com

bois-applique.com

originallollipop.com

lj0008lj.net

spfldvaccineday.info

phalcosnusa.com

llcmastermachine.com

onlyforu14.rest

bestmarketingautomations.com

officialswitchmusic.com

thepretenseofjustice.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2168-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2168-117-0x000000000041D490-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe

pid process

3144 f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe

pid	process
3144	f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe

description	pid	process	target process
PID 3144 set thread context of 2168	3144	f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe	f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe

pid	process
2168	f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe
2168	f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe

description	pid	process	target process
PID 3144 wrote to memory of 2168	3144	f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe	f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe
PID 3144 wrote to memory of 2168	3144	f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe	f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe
PID 3144 wrote to memory of 2168	3144	f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe	f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe
PID 3144 wrote to memory of 2168	3144	f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe	f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe
PID 3144 wrote to memory of 2168	3144	f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe	f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe
PID 3144 wrote to memory of 2168	3144	f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe	f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe

C:\Users\Admin\AppData\Local\Temp\f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe
"C:\Users\Admin\AppData\Local\Temp\f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3144

C:\Users\Admin\AppData\Local\Temp\f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe
"C:\Users\Admin\AppData\Local\Temp\f89bda22f77706b290e5f56032cd4c884f8da016a379f6c6a978acf4983f0175.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2168

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nssB4EF.tmp\iivedwr.dll
MD5
3e9d045c2d39e938be8d6ca201334b33

SHA1
2d186f686d45dfdd4657b905ae96976696fd8413

SHA256
017ac808ba839b52ff09e5cced4a6a7e1673a8bdbcc4f5e78d8e0ce3b05acc7d

SHA512
48ffe8f61bc0ee3121658600ae91e63631b99c1d7332898ac4e68fcde6348a6ff419d71171905c1ee1f5440e13405bbd1734fe2f3e0e460ffc0a9c86bac724d1

Download Submit
memory/2168-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2168-117-0x000000000041D490-mapping.dmp

Download
memory/2168-118-0x0000000000A50000-0x0000000000D70000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads