xloader | 612a346d3e2412113c53343b67419bc7a13bcf1bfe890137b68b3b5553a20096

General

Target

3737a705b553c9a6245722aa948a2beb.exe
Size

423KB
MD5

3737a705b553c9a6245722aa948a2beb
SHA1

b6a2abfaaffbb3560dc9ebae6f3bd14aa0594b44
SHA256

612a346d3e2412113c53343b67419bc7a13bcf1bfe890137b68b3b5553a20096
SHA512

401c211911ab46dfe85c015e2aa9c469f5486457f980c5eea4bf5e27ca74d13069c74ff9844cfd2d755e6ca44997e1ad49655bd8d383366ab40ed48e709ef22a

Score

10^/10

xloader b2c0 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3828-115-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/3828-116-0x000000000041D4C0-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

3737a705b553c9a6245722aa948a2beb.exe

pid process

3492 3737a705b553c9a6245722aa948a2beb.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

3737a705b553c9a6245722aa948a2beb.exe

description pid process target process

PID 3492 set thread context of 3828 3492 3737a705b553c9a6245722aa948a2beb.exe 3737a705b553c9a6245722aa948a2beb.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

3737a705b553c9a6245722aa948a2beb.exe

pid process

3828 3737a705b553c9a6245722aa948a2beb.exe
3828 3737a705b553c9a6245722aa948a2beb.exe

pid	process
3492	3737a705b553c9a6245722aa948a2beb.exe

description	pid	process	target process
PID 3492 set thread context of 3828	3492	3737a705b553c9a6245722aa948a2beb.exe	3737a705b553c9a6245722aa948a2beb.exe

pid	process
3828	3737a705b553c9a6245722aa948a2beb.exe
3828	3737a705b553c9a6245722aa948a2beb.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3737a705b553c9a6245722aa948a2beb.exe

description	pid	process	target process
PID 3492 wrote to memory of 3828	3492	3737a705b553c9a6245722aa948a2beb.exe	3737a705b553c9a6245722aa948a2beb.exe
PID 3492 wrote to memory of 3828	3492	3737a705b553c9a6245722aa948a2beb.exe	3737a705b553c9a6245722aa948a2beb.exe
PID 3492 wrote to memory of 3828	3492	3737a705b553c9a6245722aa948a2beb.exe	3737a705b553c9a6245722aa948a2beb.exe
PID 3492 wrote to memory of 3828	3492	3737a705b553c9a6245722aa948a2beb.exe	3737a705b553c9a6245722aa948a2beb.exe
PID 3492 wrote to memory of 3828	3492	3737a705b553c9a6245722aa948a2beb.exe	3737a705b553c9a6245722aa948a2beb.exe
PID 3492 wrote to memory of 3828	3492	3737a705b553c9a6245722aa948a2beb.exe	3737a705b553c9a6245722aa948a2beb.exe

C:\Users\Admin\AppData\Local\Temp\3737a705b553c9a6245722aa948a2beb.exe
"C:\Users\Admin\AppData\Local\Temp\3737a705b553c9a6245722aa948a2beb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3492

C:\Users\Admin\AppData\Local\Temp\3737a705b553c9a6245722aa948a2beb.exe
"C:\Users\Admin\AppData\Local\Temp\3737a705b553c9a6245722aa948a2beb.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsv61BE.tmp\wxmkcb.dll
MD5
0c830a1bd50b239167ea8a7bdd68e095

SHA1
e65f3280c817f0f7e52a52112121d17ffcbc7e5d

SHA256
b31b5199366598aa7e035d334e1f045b79902aedb13186f8ba178f9cc8d7b49a

SHA512
c81ced34a906cfcd2e79466a0cbed7bcca3d5d830dcb5b710d45ea2d572d19763bd7721c55368e80a015e716f47e0fe8f45acf30d8e8e24e9d4c0e3d00dffa17

Download Submit
memory/3828-115-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3828-116-0x000000000041D4C0-mapping.dmp

Download
memory/3828-117-0x00000000009C0000-0x0000000000CE0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing