xloader | b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be

General

Target

b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe
Size

603KB
MD5

f8ba5db8bad75222081bc6b9297126a4
SHA1

290a186a9869a6f3ded1049b1d567eafe0041f5d
SHA256

b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be
SHA512

70f90c213dfd898c3f9e91bb6855493ab894604f04ced9b910c3f37eb1bbe658b6944cc847e315d7fe9d793bf1dba8772c38ef12fbf3cf41c52fcde3adca26d5

Score

10^/10

xloader b2c0 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2584-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2584-117-0x000000000041D4C0-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe

pid process

1764 b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe

pid	process
1764	b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe

description	pid	process	target process
PID 1764 set thread context of 2584	1764	b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe	b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe

pid	process
2584	b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe
2584	b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe

description	pid	process	target process
PID 1764 wrote to memory of 2584	1764	b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe	b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe
PID 1764 wrote to memory of 2584	1764	b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe	b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe
PID 1764 wrote to memory of 2584	1764	b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe	b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe
PID 1764 wrote to memory of 2584	1764	b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe	b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe
PID 1764 wrote to memory of 2584	1764	b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe	b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe
PID 1764 wrote to memory of 2584	1764	b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe	b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe

C:\Users\Admin\AppData\Local\Temp\b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe
"C:\Users\Admin\AppData\Local\Temp\b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1764

C:\Users\Admin\AppData\Local\Temp\b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe
"C:\Users\Admin\AppData\Local\Temp\b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2584

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsoCD83.tmp\fqbakxndgg.dll
MD5
0ec0b6676a0c830fa1d12a82e0e2ccfc

SHA1
61edae0d4bb19dd31b9ed2ed4d76c99b4f04ebe2

SHA256
c168119aced865f94f0856f3d7419f33142ffe0e8f90c94205d5707b60710617

SHA512
ea5496d61a19ac03a49788d5cc7ae18603ec728c153b9c580f6faa7cfc850c297f9978429627e765467d8130409ca25ce041f0f42065d14fe53c6ef69943e574

Download Submit
memory/2584-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2584-117-0x000000000041D4C0-mapping.dmp

Download
memory/2584-118-0x0000000000A00000-0x0000000000D20000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads