xloader | b4dd5b1d79a6d7fb71d62379aec4338a4072a9736e1383d0d1ee185d02e47619

General

Target

METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe
Size

309KB
MD5

0070ab3e990bd8c6eaca780527718ace
SHA1

8079e31f033b3fe6ecc3bc5647f3d46179536fb5
SHA256

b4dd5b1d79a6d7fb71d62379aec4338a4072a9736e1383d0d1ee185d02e47619
SHA512

87df1fd9152462d6fb0c0a2310e5e9feacd124053c6487f7ae4834266fb4ec3b765f21a0456ee2038ab4546fed5b80bb488645629f5c54a727ebcdca846eb7b4

Score

10^/10

xloader dhua loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

dhua

C2

http://www.segurosramosroman.com/dhua/

Decoy

ketostar.club

icanmakeyoufamous.com

claimygdejection.com

garlicinterestedparent.xyz

bits-clicks.com

030atk.xyz

ballwiegand.com

logs-illumidesk.com

785686.com

flnewsfeed.com

transporteshrj.net

agenciamundodigital.online

bowersllc.com

urchncenw.com

wuauwuaumx.com

littlesportsacademy.com

xn--m3chb3ax0abdta3fwhk.com

prmarketings.com

jiaozhanlianmeng.com

whenisthestore.space

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/580-115-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/580-116-0x000000000041D4E0-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe

pid process

4060 METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe

pid	process
4060	METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe

description	pid	process	target process
PID 4060 set thread context of 580	4060	METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe	METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe

pid process

580 METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe
580 METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe

pid	process
580	METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe
580	METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe

description	pid	process	target process
PID 4060 wrote to memory of 580	4060	METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe	METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe
PID 4060 wrote to memory of 580	4060	METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe	METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe
PID 4060 wrote to memory of 580	4060	METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe	METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe
PID 4060 wrote to memory of 580	4060	METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe	METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe
PID 4060 wrote to memory of 580	4060	METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe	METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe
PID 4060 wrote to memory of 580	4060	METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe	METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe

C:\Users\Admin\AppData\Local\Temp\METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe
"C:\Users\Admin\AppData\Local\Temp\METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4060

C:\Users\Admin\AppData\Local\Temp\METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe
"C:\Users\Admin\AppData\Local\Temp\METALIMEX-RFQBYSM-207_SC_offer_kaismiddleeast74567377.7z.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:580

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsu490B.tmp\bqoyh.dll
MD5
2398a8915987ab4d01052d44014fa752

SHA1
a8b696f9219a3f784af4ac779529fa22c445a7a4

SHA256
adaaffcb35ec341473059471f03cc34fec4474d63361d848cff64657ed669355

SHA512
cbf3650f700cd8ca1276bf59c956a406bcf505f87fb98167d5092dc4c9099d9b76b93816fa8f4b07de4f4c0c33b2a46aeabf00d7c44aaad4e62ae6549915eafb

Download Submit
memory/580-115-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/580-116-0x000000000041D4E0-mapping.dmp

Download
memory/580-117-0x0000000000AA0000-0x0000000000DC0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads