xloader | 5da3ef49a658c41da32f3258e3124c24e9641496ea1c2443d40c680a9f7b0e8c

General

Target

Swift Copy_44000.exe
Size

320KB
MD5

03d853072e1cab50b55cce6883e5e72e
SHA1

a3d35ebdb90c950db690d900c57b804cb4874b4e
SHA256

5da3ef49a658c41da32f3258e3124c24e9641496ea1c2443d40c680a9f7b0e8c
SHA512

0229de62952ebc975333eb6ec25e9d47fd7f658e44661d198d17a8b6b833291b42f4f08e7ec41e574dd2dba8d58da54c0c0375e1d764bd26fe84fc3aa70d8116

Score

10^/10

xloader e8ia loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

e8ia

C2

http://www.helpfromjames.com/e8ia/

Decoy

le-hameau-enchanteur.com

quantumsystem-au.club

engravedeeply.com

yesrecompensas.lat

cavallitowerofficials.com

800seaspray.com

skifun-jetski.com

thouartafoot.com

nft2dollar.com

petrestore.online

cjcutthecord2.com

tippimccullough.com

gadget198.xyz

djmiriam.com

bitbasepay.com

cukierniawz.com

mcclureic.xyz

inthekitchenshakinandbakin.com

busy-clicks.com

melaniemorris.online

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3680-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/3680-117-0x000000000041D4D0-mapping.dmp	xloader
behavioral2/memory/4068-125-0x0000000000A90000-0x0000000000AB9000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

Swift Copy_44000.exe

pid process

2720 Swift Copy_44000.exe

pid	process
2720	Swift Copy_44000.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

Swift Copy_44000.exeSwift Copy_44000.exeexplorer.exe

description	pid	process	target process
PID 2720 set thread context of 3680	2720	Swift Copy_44000.exe	Swift Copy_44000.exe
PID 3680 set thread context of 3020	3680	Swift Copy_44000.exe	Explorer.EXE
PID 4068 set thread context of 3020	4068	explorer.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

Swift Copy_44000.exeexplorer.exe

pid	process
3680	Swift Copy_44000.exe
3680	Swift Copy_44000.exe
3680	Swift Copy_44000.exe
3680	Swift Copy_44000.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe
4068	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3020 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Swift Copy_44000.exeexplorer.exe

pid process

3680 Swift Copy_44000.exe
3680 Swift Copy_44000.exe
3680 Swift Copy_44000.exe
4068 explorer.exe
4068 explorer.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Swift Copy_44000.exeexplorer.exe

description pid process

Token: SeDebugPrivilege 3680 Swift Copy_44000.exe
Token: SeDebugPrivilege 4068 explorer.exe

pid	process
3020	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	3680	Swift Copy_44000.exe
Token: SeDebugPrivilege	4068	explorer.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Swift Copy_44000.exeExplorer.EXEexplorer.exe

description	pid	process	target process
PID 2720 wrote to memory of 3680	2720	Swift Copy_44000.exe	Swift Copy_44000.exe
PID 2720 wrote to memory of 3680	2720	Swift Copy_44000.exe	Swift Copy_44000.exe
PID 2720 wrote to memory of 3680	2720	Swift Copy_44000.exe	Swift Copy_44000.exe
PID 2720 wrote to memory of 3680	2720	Swift Copy_44000.exe	Swift Copy_44000.exe
PID 2720 wrote to memory of 3680	2720	Swift Copy_44000.exe	Swift Copy_44000.exe
PID 2720 wrote to memory of 3680	2720	Swift Copy_44000.exe	Swift Copy_44000.exe
PID 3020 wrote to memory of 4068	3020	Explorer.EXE	explorer.exe
PID 3020 wrote to memory of 4068	3020	Explorer.EXE	explorer.exe
PID 3020 wrote to memory of 4068	3020	Explorer.EXE	explorer.exe
PID 4068 wrote to memory of 4092	4068	explorer.exe	cmd.exe
PID 4068 wrote to memory of 4092	4068	explorer.exe	cmd.exe
PID 4068 wrote to memory of 4092	4068	explorer.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3020

C:\Users\Admin\AppData\Local\Temp\Swift Copy_44000.exe
"C:\Users\Admin\AppData\Local\Temp\Swift Copy_44000.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2720

C:\Users\Admin\AppData\Local\Temp\Swift Copy_44000.exe
"C:\Users\Admin\AppData\Local\Temp\Swift Copy_44000.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\Swift Copy_44000.exe"
3⤵
PID:4092

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsbBB62.tmp\yktbz.dll
MD5
31d640c277ad7bae2ef34f6f96a00e48

SHA1
79c82dc55f7809a09e743246c592b13738d82474

SHA256
de7e672353424bf282a669abc6002140cd1103eed39b5ddb685ffb3b0ccffe85

SHA512
d2ac29df6eeda50ca0f8252542f05a790b18d970e1d8ea7f6a2582c2dff33d948f0c616a5061c556522bc90e3cfdc69ecba0a520a8f848d577b46b220fc76934

Download Submit
memory/3020-128-0x00000000062F0000-0x0000000006427000-memory.dmp

Filesize
1.2MB

Download
memory/3020-120-0x0000000005E40000-0x0000000005F52000-memory.dmp

Filesize
1.1MB

Download
memory/3680-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3680-117-0x000000000041D4D0-mapping.dmp

Download
memory/3680-119-0x00000000009A0000-0x0000000000CC0000-memory.dmp

Filesize
3.1MB

Download
memory/3680-121-0x0000000000D10000-0x0000000000D21000-memory.dmp

Filesize
68KB

Download
memory/4068-122-0x0000000000000000-mapping.dmp

Download
memory/4068-125-0x0000000000A90000-0x0000000000AB9000-memory.dmp

Filesize
164KB

Download
memory/4068-124-0x0000000000AF0000-0x0000000000F2F000-memory.dmp

Filesize
4.2MB

Download
memory/4068-126-0x0000000004EB0000-0x00000000051D0000-memory.dmp

Filesize
3.1MB

Download
memory/4068-127-0x0000000004D00000-0x0000000004D90000-memory.dmp

Filesize
576KB

Download
memory/4092-123-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads