xloader | 7dfac85dbd9ce80d656f5cd2b657705975023c370a3f9ddd4fd63cb244862c40

General

Target

b85c005de5b04c0ba376f72cc932f26b.exe
Size

898KB
MD5

b85c005de5b04c0ba376f72cc932f26b
SHA1

04441b6a52530284bdeaa3c4ac4504d71c14101c
SHA256

7dfac85dbd9ce80d656f5cd2b657705975023c370a3f9ddd4fd63cb244862c40
SHA512

b450731148a32b503471dec833203fc434d07eaf6ae28c1cef0814a5115ddfb64a5028d1519484df0652c83732b1e6290094b5c3bd28e6e53710fcf9c3802574

Score

10^/10

xloader ea0r loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ea0r

Decoy

lionheartcreativestudios.com

konzertmanagement.com

blackpanther.online

broychim-int.com

takut18.com

txstarsolar.com

herdsherpa.com

igorshestakov.com

shinesbox.com

reflectpkljlt.xyz

oiltoolshub.com

viralmoneychallenge.com

changingalphastrategies.com

mecitiris.com

rdadmin.online

miniambiente.com

kominarcine.com

pino-almond.com

heihit.xyz

junqi888.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3532-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/3532-117-0x000000000041D410-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

b85c005de5b04c0ba376f72cc932f26b.exe

pid process

3372 b85c005de5b04c0ba376f72cc932f26b.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

b85c005de5b04c0ba376f72cc932f26b.exe

description pid process target process

PID 3372 set thread context of 3532 3372 b85c005de5b04c0ba376f72cc932f26b.exe b85c005de5b04c0ba376f72cc932f26b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

b85c005de5b04c0ba376f72cc932f26b.exe

pid process

3532 b85c005de5b04c0ba376f72cc932f26b.exe
3532 b85c005de5b04c0ba376f72cc932f26b.exe

pid	process
3372	b85c005de5b04c0ba376f72cc932f26b.exe

description	pid	process	target process
PID 3372 set thread context of 3532	3372	b85c005de5b04c0ba376f72cc932f26b.exe	b85c005de5b04c0ba376f72cc932f26b.exe

pid	process
3532	b85c005de5b04c0ba376f72cc932f26b.exe
3532	b85c005de5b04c0ba376f72cc932f26b.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

b85c005de5b04c0ba376f72cc932f26b.exe

description	pid	process	target process
PID 3372 wrote to memory of 3532	3372	b85c005de5b04c0ba376f72cc932f26b.exe	b85c005de5b04c0ba376f72cc932f26b.exe
PID 3372 wrote to memory of 3532	3372	b85c005de5b04c0ba376f72cc932f26b.exe	b85c005de5b04c0ba376f72cc932f26b.exe
PID 3372 wrote to memory of 3532	3372	b85c005de5b04c0ba376f72cc932f26b.exe	b85c005de5b04c0ba376f72cc932f26b.exe
PID 3372 wrote to memory of 3532	3372	b85c005de5b04c0ba376f72cc932f26b.exe	b85c005de5b04c0ba376f72cc932f26b.exe
PID 3372 wrote to memory of 3532	3372	b85c005de5b04c0ba376f72cc932f26b.exe	b85c005de5b04c0ba376f72cc932f26b.exe
PID 3372 wrote to memory of 3532	3372	b85c005de5b04c0ba376f72cc932f26b.exe	b85c005de5b04c0ba376f72cc932f26b.exe

C:\Users\Admin\AppData\Local\Temp\b85c005de5b04c0ba376f72cc932f26b.exe
"C:\Users\Admin\AppData\Local\Temp\b85c005de5b04c0ba376f72cc932f26b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3372

C:\Users\Admin\AppData\Local\Temp\b85c005de5b04c0ba376f72cc932f26b.exe
"C:\Users\Admin\AppData\Local\Temp\b85c005de5b04c0ba376f72cc932f26b.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3532

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nskF10.tmp\ptinspeue.dll
MD5
5457aaa44c13127b579f7529bfb97777

SHA1
d24af0e9239ce8b5324774aae5e88bf5fbdaad7c

SHA256
073036bc85bc012b4ed70b9a469708f5b2a9744bd4a943b4c9e3d2d3d48b0c99

SHA512
b0808c68815e090c3420614bfd6e81cb05d349e5bf5bc4edff6e1d3ff1df18ceb7d8a9f2c5cbb7a244fd387051b5143cf16903d94385c0c72451e17bcccba3a0

Download Submit
memory/3532-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3532-117-0x000000000041D410-mapping.dmp

Download
memory/3532-118-0x0000000000AA0000-0x0000000000DC0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing