xloader | ca63aeb4d3c007faf34aaba889aa142c87642594b5aa6bcac41a2e4aa1c4c807

General

Target

tmp/dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe
Size

359KB
MD5

09d20093b28ef892d0a7d3d6a3f09574
SHA1

05b357f88e60c31cfa3f4752d0f70dd66aa367b0
SHA256

ca63aeb4d3c007faf34aaba889aa142c87642594b5aa6bcac41a2e4aa1c4c807
SHA512

19fa0692cedb7f16e1fec497b77be0dd36d22b7f13ce380ddc492075ae69563ee139567fc93c2ceef469893c6d1a0df90863859c128f6de29ce7c1c21f1f5eb7

Score

10^/10

xloader fqiq loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

fqiq

Decoy

driventow.com

ipatchwork.today

bolder.equipment

seal-brother.com

mountlaketerraceapartments.com

weeden.xyz

sanlifalan.com

athafood.com

isshinn1.com

creationslazzaroni.com

eclecticrenaissancewoman.com

satellitephonstore.com

cotchildcare.com

yamacorp.digital

ff4cuno43.xyz

quicksticks.community

govindfinance.com

farmersfirstseed.com

megacinema.club

tablescaperendezvous4two.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/964-56-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/964-57-0x000000000041D4B0-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe

pid process

616 dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe

pid	process
616	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe

description	pid	process	target process
PID 616 set thread context of 964	616	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe

pid process

964 dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe

pid	process
964	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe

description	pid	process	target process
PID 616 wrote to memory of 964	616	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe
PID 616 wrote to memory of 964	616	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe
PID 616 wrote to memory of 964	616	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe
PID 616 wrote to memory of 964	616	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe
PID 616 wrote to memory of 964	616	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe
PID 616 wrote to memory of 964	616	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe
PID 616 wrote to memory of 964	616	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe	dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe

C:\Users\Admin\AppData\Local\Temp\tmp\dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:616

C:\Users\Admin\AppData\Local\Temp\tmp\dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\dfcae1cb-68ea-4a4b-bdf3-c951a687982a_vbc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:964

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nstF690.tmp\pcvjcsta.dll
MD5
ef8062b63953fcd3f681f2be88a4da2a

SHA1
64c477af7e0c75a8c86aa9a467431288128ef602

SHA256
d1e1f757445aa460b95e7b7cd1144a9db3e0bc017aba1ca1dfb6314c69619e89

SHA512
c687adf84718cb5835d74fc4ba8460ec209286c10e65b221a61120fde9d7efdb5d27823b17c7b5cc4fde7eb0ba75565061c5ab7549556a5975ff74e3b0e08270

Download Submit
memory/616-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/964-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/964-57-0x000000000041D4B0-mapping.dmp

Download
memory/964-58-0x0000000000800000-0x0000000000B03000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads