xloader | 2e8dbbac127f620f64817f3674be70bb481ed70e89796f387caed0a11229540c

General

Target

VSL_MV SEA-BLUE SHIP OWNERS.exe
Size

288KB
MD5

0b1723d1301f6c728884ecd4d7d0ae03
SHA1

ae99846517dfd9c3c69ec13285d089ca68419cda
SHA256

2e8dbbac127f620f64817f3674be70bb481ed70e89796f387caed0a11229540c
SHA512

5880ef204c1505200426e1f33af75e064cb425866e68644b4f0ba7d235bc6e273017a22889a6869e146efdaff674c37cd10b416ee9d4d94e3681d1a1dc609d5c

Score

10^/10

xloader e8ia loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

e8ia

C2

http://www.helpfromjames.com/e8ia/

Decoy

le-hameau-enchanteur.com

quantumsystem-au.club

engravedeeply.com

yesrecompensas.lat

cavallitowerofficials.com

800seaspray.com

skifun-jetski.com

thouartafoot.com

nft2dollar.com

petrestore.online

cjcutthecord2.com

tippimccullough.com

gadget198.xyz

djmiriam.com

bitbasepay.com

cukierniawz.com

mcclureic.xyz

inthekitchenshakinandbakin.com

busy-clicks.com

melaniemorris.online

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3944-119-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/3944-120-0x000000000041D4D0-mapping.dmp	xloader
behavioral2/memory/4064-127-0x0000000002F70000-0x0000000002F99000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

VSL_MV SEA-BLUE SHIP OWNERS.exe

pid process

2772 VSL_MV SEA-BLUE SHIP OWNERS.exe

pid	process
2772	VSL_MV SEA-BLUE SHIP OWNERS.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

VSL_MV SEA-BLUE SHIP OWNERS.exeVSL_MV SEA-BLUE SHIP OWNERS.exeraserver.exe

description	pid	process	target process
PID 2772 set thread context of 3944	2772	VSL_MV SEA-BLUE SHIP OWNERS.exe	VSL_MV SEA-BLUE SHIP OWNERS.exe
PID 3944 set thread context of 3036	3944	VSL_MV SEA-BLUE SHIP OWNERS.exe	Explorer.EXE
PID 4064 set thread context of 3036	4064	raserver.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

VSL_MV SEA-BLUE SHIP OWNERS.exeraserver.exe

pid	process
3944	VSL_MV SEA-BLUE SHIP OWNERS.exe
3944	VSL_MV SEA-BLUE SHIP OWNERS.exe
3944	VSL_MV SEA-BLUE SHIP OWNERS.exe
3944	VSL_MV SEA-BLUE SHIP OWNERS.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe
4064	raserver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3036 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

VSL_MV SEA-BLUE SHIP OWNERS.exeraserver.exe

pid process

3944 VSL_MV SEA-BLUE SHIP OWNERS.exe
3944 VSL_MV SEA-BLUE SHIP OWNERS.exe
3944 VSL_MV SEA-BLUE SHIP OWNERS.exe
4064 raserver.exe
4064 raserver.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

VSL_MV SEA-BLUE SHIP OWNERS.exeraserver.exe

description pid process

Token: SeDebugPrivilege 3944 VSL_MV SEA-BLUE SHIP OWNERS.exe
Token: SeDebugPrivilege 4064 raserver.exe

pid	process
3036	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	3944	VSL_MV SEA-BLUE SHIP OWNERS.exe
Token: SeDebugPrivilege	4064	raserver.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

VSL_MV SEA-BLUE SHIP OWNERS.exeExplorer.EXEraserver.exe

description	pid	process	target process
PID 2772 wrote to memory of 3944	2772	VSL_MV SEA-BLUE SHIP OWNERS.exe	VSL_MV SEA-BLUE SHIP OWNERS.exe
PID 2772 wrote to memory of 3944	2772	VSL_MV SEA-BLUE SHIP OWNERS.exe	VSL_MV SEA-BLUE SHIP OWNERS.exe
PID 2772 wrote to memory of 3944	2772	VSL_MV SEA-BLUE SHIP OWNERS.exe	VSL_MV SEA-BLUE SHIP OWNERS.exe
PID 2772 wrote to memory of 3944	2772	VSL_MV SEA-BLUE SHIP OWNERS.exe	VSL_MV SEA-BLUE SHIP OWNERS.exe
PID 2772 wrote to memory of 3944	2772	VSL_MV SEA-BLUE SHIP OWNERS.exe	VSL_MV SEA-BLUE SHIP OWNERS.exe
PID 2772 wrote to memory of 3944	2772	VSL_MV SEA-BLUE SHIP OWNERS.exe	VSL_MV SEA-BLUE SHIP OWNERS.exe
PID 3036 wrote to memory of 4064	3036	Explorer.EXE	raserver.exe
PID 3036 wrote to memory of 4064	3036	Explorer.EXE	raserver.exe
PID 3036 wrote to memory of 4064	3036	Explorer.EXE	raserver.exe
PID 4064 wrote to memory of 3644	4064	raserver.exe	cmd.exe
PID 4064 wrote to memory of 3644	4064	raserver.exe	cmd.exe
PID 4064 wrote to memory of 3644	4064	raserver.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3036

C:\Users\Admin\AppData\Local\Temp\VSL_MV SEA-BLUE SHIP OWNERS.exe
"C:\Users\Admin\AppData\Local\Temp\VSL_MV SEA-BLUE SHIP OWNERS.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2772

C:\Users\Admin\AppData\Local\Temp\VSL_MV SEA-BLUE SHIP OWNERS.exe
"C:\Users\Admin\AppData\Local\Temp\VSL_MV SEA-BLUE SHIP OWNERS.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3944

C:\Windows\SysWOW64\raserver.exe
"C:\Windows\SysWOW64\raserver.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\VSL_MV SEA-BLUE SHIP OWNERS.exe"
3⤵
PID:3644

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsh886C.tmp\oossyesm.dll
MD5
466537c1f36e8f00cabbdda451bea83c

SHA1
56cf8989ce0eb1199ec325a899f5fd43625ee429

SHA256
8af8280ecf9055a93b3aa88539f675e4963a53a7d1eaecccad283693ed391d2e

SHA512
c0b22b4eb3f32a3c0e7ab4c3856759774d00b41c3ac3764eadf1f4b8056bba8ff1efa55b4519922c558c1f6f143668c3b8ece188f4bcae6b9a1b8c240d71f05b

Download Submit
memory/3036-124-0x0000000002150000-0x00000000021FE000-memory.dmp

Filesize
696KB

Download
memory/3036-131-0x0000000002650000-0x0000000002722000-memory.dmp

Filesize
840KB

Download
memory/3644-128-0x0000000000000000-mapping.dmp

Download
memory/3944-123-0x00000000008E0000-0x00000000008F1000-memory.dmp

Filesize
68KB

Download
memory/3944-122-0x00000000009F0000-0x0000000000D10000-memory.dmp

Filesize
3.1MB

Download
memory/3944-120-0x000000000041D4D0-mapping.dmp

Download
memory/3944-119-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4064-125-0x0000000000000000-mapping.dmp

Download
memory/4064-127-0x0000000002F70000-0x0000000002F99000-memory.dmp

Filesize
164KB

Download
memory/4064-126-0x0000000000E60000-0x0000000000E7F000-memory.dmp

Filesize
124KB

Download
memory/4064-129-0x0000000005180000-0x00000000054A0000-memory.dmp

Filesize
3.1MB

Download
memory/4064-130-0x0000000004EE0000-0x0000000004F70000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads