xloader | 2e8dbbac127f620f64817f3674be70bb481ed70e89796f387caed0a11229540c

General

Target

VSL_MV SEA-BLUE SHIP OWNERS.exe
Size

288KB
MD5

0b1723d1301f6c728884ecd4d7d0ae03
SHA1

ae99846517dfd9c3c69ec13285d089ca68419cda
SHA256

2e8dbbac127f620f64817f3674be70bb481ed70e89796f387caed0a11229540c
SHA512

5880ef204c1505200426e1f33af75e064cb425866e68644b4f0ba7d235bc6e273017a22889a6869e146efdaff674c37cd10b416ee9d4d94e3681d1a1dc609d5c

Score

10^/10

xloader e8ia loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

e8ia

C2

http://www.helpfromjames.com/e8ia/

Decoy

le-hameau-enchanteur.com

quantumsystem-au.club

engravedeeply.com

yesrecompensas.lat

cavallitowerofficials.com

800seaspray.com

skifun-jetski.com

thouartafoot.com

nft2dollar.com

petrestore.online

cjcutthecord2.com

tippimccullough.com

gadget198.xyz

djmiriam.com

bitbasepay.com

cukierniawz.com

mcclureic.xyz

inthekitchenshakinandbakin.com

busy-clicks.com

melaniemorris.online

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1492-57-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1492-58-0x000000000041D4D0-mapping.dmp	xloader
behavioral1/memory/1928-67-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1808 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

VSL_MV SEA-BLUE SHIP OWNERS.exe

pid process

2036 VSL_MV SEA-BLUE SHIP OWNERS.exe

pid	process
1808	cmd.exe

pid	process
2036	VSL_MV SEA-BLUE SHIP OWNERS.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

VSL_MV SEA-BLUE SHIP OWNERS.exeVSL_MV SEA-BLUE SHIP OWNERS.exeraserver.exe

description	pid	process	target process
PID 2036 set thread context of 1492	2036	VSL_MV SEA-BLUE SHIP OWNERS.exe	VSL_MV SEA-BLUE SHIP OWNERS.exe
PID 1492 set thread context of 1272	1492	VSL_MV SEA-BLUE SHIP OWNERS.exe	Explorer.EXE
PID 1928 set thread context of 1272	1928	raserver.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

VSL_MV SEA-BLUE SHIP OWNERS.exeraserver.exe

pid	process
1492	VSL_MV SEA-BLUE SHIP OWNERS.exe
1492	VSL_MV SEA-BLUE SHIP OWNERS.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe
1928	raserver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1272 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

VSL_MV SEA-BLUE SHIP OWNERS.exeraserver.exe

pid process

1492 VSL_MV SEA-BLUE SHIP OWNERS.exe
1492 VSL_MV SEA-BLUE SHIP OWNERS.exe
1492 VSL_MV SEA-BLUE SHIP OWNERS.exe
1928 raserver.exe
1928 raserver.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

VSL_MV SEA-BLUE SHIP OWNERS.exeraserver.exe

description pid process

Token: SeDebugPrivilege 1492 VSL_MV SEA-BLUE SHIP OWNERS.exe
Token: SeDebugPrivilege 1928 raserver.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1272 Explorer.EXE
1272 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1272 Explorer.EXE
1272 Explorer.EXE

pid	process
1272	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1492	VSL_MV SEA-BLUE SHIP OWNERS.exe
Token: SeDebugPrivilege	1928	raserver.exe

pid	process
1272	Explorer.EXE
1272	Explorer.EXE

pid	process
1272	Explorer.EXE
1272	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

VSL_MV SEA-BLUE SHIP OWNERS.exeExplorer.EXEraserver.exe

description	pid	process	target process
PID 2036 wrote to memory of 1492	2036	VSL_MV SEA-BLUE SHIP OWNERS.exe	VSL_MV SEA-BLUE SHIP OWNERS.exe
PID 2036 wrote to memory of 1492	2036	VSL_MV SEA-BLUE SHIP OWNERS.exe	VSL_MV SEA-BLUE SHIP OWNERS.exe
PID 2036 wrote to memory of 1492	2036	VSL_MV SEA-BLUE SHIP OWNERS.exe	VSL_MV SEA-BLUE SHIP OWNERS.exe
PID 2036 wrote to memory of 1492	2036	VSL_MV SEA-BLUE SHIP OWNERS.exe	VSL_MV SEA-BLUE SHIP OWNERS.exe
PID 2036 wrote to memory of 1492	2036	VSL_MV SEA-BLUE SHIP OWNERS.exe	VSL_MV SEA-BLUE SHIP OWNERS.exe
PID 2036 wrote to memory of 1492	2036	VSL_MV SEA-BLUE SHIP OWNERS.exe	VSL_MV SEA-BLUE SHIP OWNERS.exe
PID 2036 wrote to memory of 1492	2036	VSL_MV SEA-BLUE SHIP OWNERS.exe	VSL_MV SEA-BLUE SHIP OWNERS.exe
PID 1272 wrote to memory of 1928	1272	Explorer.EXE	raserver.exe
PID 1272 wrote to memory of 1928	1272	Explorer.EXE	raserver.exe
PID 1272 wrote to memory of 1928	1272	Explorer.EXE	raserver.exe
PID 1272 wrote to memory of 1928	1272	Explorer.EXE	raserver.exe
PID 1928 wrote to memory of 1808	1928	raserver.exe	cmd.exe
PID 1928 wrote to memory of 1808	1928	raserver.exe	cmd.exe
PID 1928 wrote to memory of 1808	1928	raserver.exe	cmd.exe
PID 1928 wrote to memory of 1808	1928	raserver.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272

C:\Users\Admin\AppData\Local\Temp\VSL_MV SEA-BLUE SHIP OWNERS.exe
"C:\Users\Admin\AppData\Local\Temp\VSL_MV SEA-BLUE SHIP OWNERS.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2036

C:\Users\Admin\AppData\Local\Temp\VSL_MV SEA-BLUE SHIP OWNERS.exe
"C:\Users\Admin\AppData\Local\Temp\VSL_MV SEA-BLUE SHIP OWNERS.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\SysWOW64\raserver.exe
"C:\Windows\SysWOW64\raserver.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\VSL_MV SEA-BLUE SHIP OWNERS.exe"
3⤵
- Deletes itself
PID:1808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsyB3F5.tmp\oossyesm.dll
MD5
466537c1f36e8f00cabbdda451bea83c

SHA1
56cf8989ce0eb1199ec325a899f5fd43625ee429

SHA256
8af8280ecf9055a93b3aa88539f675e4963a53a7d1eaecccad283693ed391d2e

SHA512
c0b22b4eb3f32a3c0e7ab4c3856759774d00b41c3ac3764eadf1f4b8056bba8ff1efa55b4519922c558c1f6f143668c3b8ece188f4bcae6b9a1b8c240d71f05b

Download Submit
memory/1272-62-0x0000000004C80000-0x0000000004D7B000-memory.dmp

Filesize
1004KB

Download
memory/1272-70-0x0000000006BB0000-0x0000000006CCE000-memory.dmp

Filesize
1.1MB

Download
memory/1492-58-0x000000000041D4D0-mapping.dmp

Download
memory/1492-61-0x00000000002C0000-0x00000000002D1000-memory.dmp

Filesize
68KB

Download
memory/1492-60-0x0000000000830000-0x0000000000B33000-memory.dmp

Filesize
3.0MB

Download
memory/1492-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1808-65-0x0000000000000000-mapping.dmp

Download
memory/1928-63-0x0000000000000000-mapping.dmp

Download
memory/1928-66-0x0000000000E60000-0x0000000000E7C000-memory.dmp

Filesize
112KB

Download
memory/1928-68-0x0000000002280000-0x0000000002583000-memory.dmp

Filesize
3.0MB

Download
memory/1928-67-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/1928-69-0x00000000008F0000-0x0000000000980000-memory.dmp

Filesize
576KB

Download
memory/2036-55-0x0000000075731000-0x0000000075733000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads