xloader | 7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e

General

Target

7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe
Size

253KB
MD5

5e9c6466f89089a73465bec3e84f6731
SHA1

7faa635ff81bf5a1ff5b56109f9d0a7088b5c1d1
SHA256

7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e
SHA512

84241a9a1d1e700c52a736cf9d1225300c4d5c14485533aa08429b2c01f0d712067ba90c334ec474f997d8686e8433b08d1e5c925b6aeda6892c71cd17ad842b

Score

10^/10

xloader ons6 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ons6

C2

http://www.parasitevhs.net/ons6/

Decoy

946acc.net

ilkermulla.com

edificationhub.com

aptbaby.com

luisrgonzalez.com

postandpine.com

objective-object.com

storeydrive.rentals

mobile-find.com

africanbridaluk.com

zzjn12.xyz

ritechoiceinvestmentgroup.com

zitzies.xyz

trulyproofreading.com

ktndetermine.xyz

advertising.land

keywordgomuwk.xyz

niecliomusicspirit.com

lhortelecom.com

cryptochieftan.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/316-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/316-117-0x000000000041D400-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe

pid process

1588 7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe

pid	process
1588	7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe

description	pid	process	target process
PID 1588 set thread context of 316	1588	7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe	7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe

pid	process
316	7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe
316	7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe

description	pid	process	target process
PID 1588 wrote to memory of 316	1588	7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe	7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe
PID 1588 wrote to memory of 316	1588	7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe	7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe
PID 1588 wrote to memory of 316	1588	7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe	7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe
PID 1588 wrote to memory of 316	1588	7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe	7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe
PID 1588 wrote to memory of 316	1588	7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe	7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe
PID 1588 wrote to memory of 316	1588	7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe	7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe

C:\Users\Admin\AppData\Local\Temp\7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe
"C:\Users\Admin\AppData\Local\Temp\7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1588

C:\Users\Admin\AppData\Local\Temp\7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe
"C:\Users\Admin\AppData\Local\Temp\7d1119a09c3f150ab964941c3a539fa3d1257cdb980df7e1535012378ae3974e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:316

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsf5030.tmp\rnzyao.dll
MD5
70e70786ba2215991447cbbf5706f54f

SHA1
5477a0ec6586cff23039a387f3a1c8968a945d6d

SHA256
cc86b72fe9369a197c80b38555433c296e0e46808b74d75ad719799087642be0

SHA512
35471023269d350004827ee5565804eaddf01f75ecfa4944e339ae8ec1dd73470a3b11301b00739bd924de1fda9bd2d03d1437455fe78dace83bb6dadd9fda9a

Download Submit
memory/316-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/316-117-0x000000000041D400-mapping.dmp

Download
memory/316-118-0x0000000000A20000-0x0000000000D40000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads