xloader | a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9

General

Target

a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe
Size

456KB
MD5

840e01d333583e11b123c378fc7741e4
SHA1

8b9e42afa53aedfbe89964ce50ab2dd15f7cb725
SHA256

a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9
SHA512

b39014a8ea82150672fe19a9d8082f85c156b925beba308207ae08d8bdd5d8ff1bdb52a04e93aa044ddf1bad7e70607c0095ced6b624c01d32ba6db67479166f

Score

10^/10

xloader fqiq loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

fqiq

Decoy

driventow.com

ipatchwork.today

bolder.equipment

seal-brother.com

mountlaketerraceapartments.com

weeden.xyz

sanlifalan.com

athafood.com

isshinn1.com

creationslazzaroni.com

eclecticrenaissancewoman.com

satellitephonstore.com

cotchildcare.com

yamacorp.digital

ff4cuno43.xyz

quicksticks.community

govindfinance.com

farmersfirstseed.com

megacinema.club

tablescaperendezvous4two.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2276-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2276-117-0x000000000041D4B0-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe

pid process

2768 a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe

pid	process
2768	a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe

description	pid	process	target process
PID 2768 set thread context of 2276	2768	a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe	a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe

pid	process
2276	a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe
2276	a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe

description	pid	process	target process
PID 2768 wrote to memory of 2276	2768	a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe	a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe
PID 2768 wrote to memory of 2276	2768	a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe	a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe
PID 2768 wrote to memory of 2276	2768	a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe	a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe
PID 2768 wrote to memory of 2276	2768	a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe	a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe
PID 2768 wrote to memory of 2276	2768	a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe	a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe
PID 2768 wrote to memory of 2276	2768	a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe	a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe

C:\Users\Admin\AppData\Local\Temp\a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe
"C:\Users\Admin\AppData\Local\Temp\a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2768

C:\Users\Admin\AppData\Local\Temp\a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe
"C:\Users\Admin\AppData\Local\Temp\a1b040465bd651704642deeb02ab2aa060f2f64183b297062c011e10456279a9.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2276

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsvD1AA.tmp\hzjmhbnx.dll
MD5
bfbb483d15bf9f4317a7a90705420d37

SHA1
882a372e8a6e3b1919575d4a6c0b272a70d1e25b

SHA256
e28343ba0653927426e44d68768b74ea19c4a3862b9c488a2d7537ccfd4dfe93

SHA512
78d4e07f8661b160fe22948ad3aa71a218e8db4a4e67bfc0f99e7c9096156019537af4a8626e8d26a40f35c23ce61be2fa66eaf92b11a78551cc21b5b509fe5c

Download Submit
memory/2276-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2276-117-0x000000000041D4B0-mapping.dmp

Download
memory/2276-118-0x0000000000A90000-0x0000000000DB0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads