xloader | cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4

General

Target

cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe
Size

647KB
MD5

69d6376700fcedd8295c6736ac7a121a
SHA1

f2b84b76afd3e3c47be10841e7532cf8092564d5
SHA256

cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4
SHA512

b1d39422cd39db688d15701171932a49b93f6e1b3dd34e5113e961ec7c89fc2820c4a7a2c049ecdbf54dfe0aff0eecf2c20c74688c0b352bfbdd62eb6f63747b

Score

10^/10

xloader ea0r loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ea0r

C2

http://www.asiapubz-hk.com/ea0r/

Decoy

lionheartcreativestudios.com

konzertmanagement.com

blackpanther.online

broychim-int.com

takut18.com

txstarsolar.com

herdsherpa.com

igorshestakov.com

shinesbox.com

reflectpkljlt.xyz

oiltoolshub.com

viralmoneychallenge.com

changingalphastrategies.com

mecitiris.com

rdadmin.online

miniambiente.com

kominarcine.com

pino-almond.com

heihit.xyz

junqi888.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2560-119-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2560-120-0x000000000041D410-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe

pid process

3700 cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe

pid	process
3700	cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe

description	pid	process	target process
PID 3700 set thread context of 2560	3700	cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe	cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe

pid	process
2560	cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe
2560	cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe

description	pid	process	target process
PID 3700 wrote to memory of 2560	3700	cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe	cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe
PID 3700 wrote to memory of 2560	3700	cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe	cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe
PID 3700 wrote to memory of 2560	3700	cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe	cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe
PID 3700 wrote to memory of 2560	3700	cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe	cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe
PID 3700 wrote to memory of 2560	3700	cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe	cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe
PID 3700 wrote to memory of 2560	3700	cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe	cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe

C:\Users\Admin\AppData\Local\Temp\cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe
"C:\Users\Admin\AppData\Local\Temp\cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3700

C:\Users\Admin\AppData\Local\Temp\cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe
"C:\Users\Admin\AppData\Local\Temp\cd1a6d25a6ecd13b937b860ddbe024fa1927d9ca766121d54eac046c5511cad4.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsp9E16.tmp\extrjocw.dll
MD5
feab530e81c9419011fd3c83790c93ca

SHA1
4421a6f114b3286fd512ff0130efbf56c0831be9

SHA256
c4cd4677caae8f56cf40d561167fff7734425a53d08109faab11bd958d4629df

SHA512
d2c781d4c01146f0f4f7ca5a0cadc856ac91dbbbd598f4b2bd3298daa4e8641bc61a7149c1b89c46443bc2b8d050766be2176f0c1fc393d34a2d8b6329caf5da

Download Submit
memory/2560-119-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2560-120-0x000000000041D410-mapping.dmp

Download
memory/2560-121-0x0000000000A10000-0x0000000000D30000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads