xloader | 4229b3a610aeed61f70687dd3a4853b2fedf562700a20fdff73d972468a26a02

Analysis

max time kernel
12s
max time network
21s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
19/01/2022, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
befa7d4266bb302167240cecf6228bfc.exe
Size 308KB
Sample220119-k3xamagfbk
SHA256 4229b3a610aeed61f70687dd3a4853b2fedf562700a20fdff73d972468a26a02
MD5 befa7d4266bb302167240cecf6228bfc
SHA1 81ff7991e8a4268d4ac509c8727630aa217cf44d
SHA512 377045a5168621bab25893a7f623e26d5aa96401e82d8f2d485f4948f26b13730247ad07017a10b1c33b2ed0466af844cc127771a6aa948cd2d637523301dc61
MD5 SHA1 SHA512

Score

10^/10

xloader yrcy loader rat

Malware Config

Extracted

Family

xloader

Version

Campaign

yrcy

Decoy

ordermws-brands.com
jkbswj.com
dairatwsl.com
lewismiddleton.com
hevenorfeed.com
kovogueshop.com
cyberitconsultingz.com
besrbee.com
workerscompfl1.com
wayfinderacu.com
smplkindness.com
servicesitcy.com
babyvv.com
fly-crypto.com
chahuima.com
trist-n.tech
minjia56.com
oded.top
mes-dents-blanches.com
nethunsleather.com
onlinesindh.com
genrage.com
bhalawat.com
5gwirelesszone.com
semejnyjochag.com
shopvintageallure.com
laqueenbeautybar.supplies
hominyprintingmuseum.com
taksimbet13.com
fairytalesinc.com
loversscout.com
nxn-n.com
lovebydarius.store
mintnft.tours
snowjamproductiosmedia.com
boraviajar.website
cryptointelcenter.com
m2momshealth.com
perfectionbyinjection.com
cletechsolutions.com
skin4trade.com
a9d7c19f0282.com
waltersswholesale.com
lendsoar.com
virginialandsforsale.com
shinepatio.com
nba2klocker.team
picturebookoriginals.com
chatteusa.com
bodevolidu.quest
certidaoja.com
scgxjp.com
cbd-cannabis-store.com
kadinisigi.com
vacoveco.com
hostedexchangemaintainces.com
hf59184.com
jingguanfm.com
browsealto.com
kymyra.com
xrgoods.com
dtsddcpj.com
uptimisedmc.com
redsigndesign.com
drmichaelirvine.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2364-131-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

pid	Process
1288	befa7d4266bb302167240cecf6228bfc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1288 set thread context of 2364	1288	befa7d4266bb302167240cecf6228bfc.exe	52

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2364	1288	befa7d4266bb302167240cecf6228bfc.exe	52
PID 1288 wrote to memory of 2364	1288	befa7d4266bb302167240cecf6228bfc.exe	52
PID 1288 wrote to memory of 2364	1288	befa7d4266bb302167240cecf6228bfc.exe	52
PID 1288 wrote to memory of 2364	1288	befa7d4266bb302167240cecf6228bfc.exe	52
PID 1288 wrote to memory of 2364	1288	befa7d4266bb302167240cecf6228bfc.exe	52
PID 1288 wrote to memory of 2364	1288	befa7d4266bb302167240cecf6228bfc.exe	52

C:\Users\Admin\AppData\Local\Temp\befa7d4266bb302167240cecf6228bfc.exe
"C:\Users\Admin\AppData\Local\Temp\befa7d4266bb302167240cecf6228bfc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Users\Admin\AppData\Local\Temp\befa7d4266bb302167240cecf6228bfc.exe
  "C:\Users\Admin\AppData\Local\Temp\befa7d4266bb302167240cecf6228bfc.exe"
  2⤵
  PID:2364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2364-131-0x0000000000400000-0x0000000000429000-memory.dmp

Download