xloader | b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be

General

Target

4.exe
Size

603KB
MD5

f8ba5db8bad75222081bc6b9297126a4
SHA1

290a186a9869a6f3ded1049b1d567eafe0041f5d
SHA256

b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be
SHA512

70f90c213dfd898c3f9e91bb6855493ab894604f04ced9b910c3f37eb1bbe658b6944cc847e315d7fe9d793bf1dba8772c38ef12fbf3cf41c52fcde3adca26d5

Score

10^/10

xloader b2c0 loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2720-115-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/2720-116-0x000000000041D4C0-mapping.dmp	xloader
behavioral2/memory/388-123-0x0000000002960000-0x0000000002989000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

4.exe

pid process

996 4.exe

pid	process
996	4.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

4.exe4.exesvchost.exe

description	pid	process	target process
PID 996 set thread context of 2720	996	4.exe	4.exe
PID 2720 set thread context of 2180	2720	4.exe	Explorer.EXE
PID 388 set thread context of 2180	388	svchost.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

4.exesvchost.exe

pid	process
2720	4.exe
2720	4.exe
2720	4.exe
2720	4.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe
388	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2180 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

4.exesvchost.exe

pid process

2720 4.exe
2720 4.exe
2720 4.exe
388 svchost.exe
388 svchost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

4.exesvchost.exe

description pid process

Token: SeDebugPrivilege 2720 4.exe
Token: SeDebugPrivilege 388 svchost.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

2180 Explorer.EXE

pid	process
2180	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	2720	4.exe
Token: SeDebugPrivilege	388	svchost.exe

pid	process
2180	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

4.exeExplorer.EXEsvchost.exe

description	pid	process	target process
PID 996 wrote to memory of 2720	996	4.exe	4.exe
PID 996 wrote to memory of 2720	996	4.exe	4.exe
PID 996 wrote to memory of 2720	996	4.exe	4.exe
PID 996 wrote to memory of 2720	996	4.exe	4.exe
PID 996 wrote to memory of 2720	996	4.exe	4.exe
PID 996 wrote to memory of 2720	996	4.exe	4.exe
PID 2180 wrote to memory of 388	2180	Explorer.EXE	svchost.exe
PID 2180 wrote to memory of 388	2180	Explorer.EXE	svchost.exe
PID 2180 wrote to memory of 388	2180	Explorer.EXE	svchost.exe
PID 388 wrote to memory of 2020	388	svchost.exe	cmd.exe
PID 388 wrote to memory of 2020	388	svchost.exe	cmd.exe
PID 388 wrote to memory of 2020	388	svchost.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2180

C:\Users\Admin\AppData\Local\Temp\4.exe
"C:\Users\Admin\AppData\Local\Temp\4.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:996

C:\Users\Admin\AppData\Local\Temp\4.exe
"C:\Users\Admin\AppData\Local\Temp\4.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\4.exe"
3⤵
PID:2020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsqC74E.tmp\fqbakxndgg.dll
MD5
0ec0b6676a0c830fa1d12a82e0e2ccfc

SHA1
61edae0d4bb19dd31b9ed2ed4d76c99b4f04ebe2

SHA256
c168119aced865f94f0856f3d7419f33142ffe0e8f90c94205d5707b60710617

SHA512
ea5496d61a19ac03a49788d5cc7ae18603ec728c153b9c580f6faa7cfc850c297f9978429627e765467d8130409ca25ce041f0f42065d14fe53c6ef69943e574

Download Submit
memory/388-121-0x0000000000000000-mapping.dmp

Download
memory/388-126-0x0000000002D50000-0x0000000002DE0000-memory.dmp

Filesize
576KB

Download
memory/388-125-0x0000000002E50000-0x0000000003170000-memory.dmp

Filesize
3.1MB

Download
memory/388-123-0x0000000002960000-0x0000000002989000-memory.dmp

Filesize
164KB

Download
memory/388-122-0x00000000000B0000-0x00000000000BC000-memory.dmp

Filesize
48KB

Download
memory/2020-124-0x0000000000000000-mapping.dmp

Download
memory/2180-119-0x0000000005660000-0x0000000005803000-memory.dmp

Filesize
1.6MB

Download
memory/2180-127-0x0000000002F70000-0x000000000300D000-memory.dmp

Filesize
628KB

Download
memory/2720-120-0x0000000000CF0000-0x0000000000D01000-memory.dmp

Filesize
68KB

Download
memory/2720-118-0x0000000000990000-0x0000000000CB0000-memory.dmp

Filesize
3.1MB

Download
memory/2720-116-0x000000000041D4C0-mapping.dmp

Download
memory/2720-115-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads