xloader | c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e

General

Target

c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe
Size

279KB
MD5

c0b3e89e6ae15becdebd353a165b61ac
SHA1

276eead9497fdfddd51259240b69008cca8ce7a1
SHA256

c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e
SHA512

9ff47712d6cdbcf75ec06d12b1a021d53e474bd2888bec0e7eed1a7d59370f8ddb087ccf19e983e86c1aa28f77df3927dd1124c1a55233bb3fc7f024a2446c6e

Score

10^/10

xloader jdo2 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

jdo2

Decoy

adopte-un-per.com

lmandarin.com

shonemurawni.quest

bantasis.com

jsdigitalekuns.net

hiddenroom.net

arungjerampangalengan.com

yinghongxw.com

buzzcupid.com

lattent.digital

faxtoemailguide.com

romanticfriryrose.com

ruleaou.com

mochiko-blog.com

sekireixploit.com

bcx-wiremesh.com

jobportalsg.com

wysspirit.com

iflycny.com

sh-cy17.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1196-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe

pid process

3876 c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe

pid	process
3876	c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe

description	pid	process	target process
PID 3876 set thread context of 1196	3876	c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe	c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe

pid	process
1196	c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe
1196	c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe

description	pid	process	target process
PID 3876 wrote to memory of 1196	3876	c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe	c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe
PID 3876 wrote to memory of 1196	3876	c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe	c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe
PID 3876 wrote to memory of 1196	3876	c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe	c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe
PID 3876 wrote to memory of 1196	3876	c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe	c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe
PID 3876 wrote to memory of 1196	3876	c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe	c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe
PID 3876 wrote to memory of 1196	3876	c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe	c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe

C:\Users\Admin\AppData\Local\Temp\c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe
"C:\Users\Admin\AppData\Local\Temp\c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3876

C:\Users\Admin\AppData\Local\Temp\c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe
"C:\Users\Admin\AppData\Local\Temp\c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1196

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsy31CC.tmp\didkwabxnlw.dll
MD5
98709684ba865fdd50852d37eb9916eb

SHA1
0b686cab705cff0926175d90071baf0e8041ec79

SHA256
c9e76980aa94accae61d594f1879096e848ae9189690f5e100953bbafe7591e6

SHA512
06b2c4e2837998cbb9d74f4bd655669055f766536e46fa2e7f2b6901dda1fb19c2c3e7ce1c0cd1c3dba92e71983667d953cf8a996a0e847b4f99eb0ffe1201c1

Download Submit
memory/1196-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1196-117-0x00000000009D0000-0x0000000000CF0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads