xloader | da99d68a728c3a14d186c03c30b551914fe57073f231d334be7955131cb5f921

General

Target

550160d122f85c9502a7a8e219dc68f3.exe
Size

458KB
MD5

550160d122f85c9502a7a8e219dc68f3
SHA1

fd2833f0eea85cccc795ffe375d1503a0df739bf
SHA256

da99d68a728c3a14d186c03c30b551914fe57073f231d334be7955131cb5f921
SHA512

91bb9d6eb11d86c928efbcab59e96263114be910f73629d0f356e47e5424bb0aedfa8629cf19f789ecda61e1f7ee7f00963d7c47c18b25922dc487c9f293f00c

Score

10^/10

xloader nt3f loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

nt3f

Decoy

tricyclee.com

kxsw999.com

wisteria-pavilion.com

bellaclancy.com

promissioskincare.com

hzy001.xyz

checkouthomehd.com

soladere.com

point4sales.com

socalmafia.com

libertadysarmiento.online

nftthirty.com

digitalgoldcryptostock.net

tulekiloscaird.com

austinfishandchicken.com

wlxxch.com

mgav51.xyz

landbanking.global

saprove.com

babyfaces.skin

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/468-56-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

550160d122f85c9502a7a8e219dc68f3.exe

pid process

1276 550160d122f85c9502a7a8e219dc68f3.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

550160d122f85c9502a7a8e219dc68f3.exe

description pid process target process

PID 1276 set thread context of 468 1276 550160d122f85c9502a7a8e219dc68f3.exe 550160d122f85c9502a7a8e219dc68f3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

550160d122f85c9502a7a8e219dc68f3.exe

pid process

468 550160d122f85c9502a7a8e219dc68f3.exe

pid	process
1276	550160d122f85c9502a7a8e219dc68f3.exe

description	pid	process	target process
PID 1276 set thread context of 468	1276	550160d122f85c9502a7a8e219dc68f3.exe	550160d122f85c9502a7a8e219dc68f3.exe

pid	process
468	550160d122f85c9502a7a8e219dc68f3.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

550160d122f85c9502a7a8e219dc68f3.exe

description	pid	process	target process
PID 1276 wrote to memory of 468	1276	550160d122f85c9502a7a8e219dc68f3.exe	550160d122f85c9502a7a8e219dc68f3.exe
PID 1276 wrote to memory of 468	1276	550160d122f85c9502a7a8e219dc68f3.exe	550160d122f85c9502a7a8e219dc68f3.exe
PID 1276 wrote to memory of 468	1276	550160d122f85c9502a7a8e219dc68f3.exe	550160d122f85c9502a7a8e219dc68f3.exe
PID 1276 wrote to memory of 468	1276	550160d122f85c9502a7a8e219dc68f3.exe	550160d122f85c9502a7a8e219dc68f3.exe
PID 1276 wrote to memory of 468	1276	550160d122f85c9502a7a8e219dc68f3.exe	550160d122f85c9502a7a8e219dc68f3.exe
PID 1276 wrote to memory of 468	1276	550160d122f85c9502a7a8e219dc68f3.exe	550160d122f85c9502a7a8e219dc68f3.exe
PID 1276 wrote to memory of 468	1276	550160d122f85c9502a7a8e219dc68f3.exe	550160d122f85c9502a7a8e219dc68f3.exe

C:\Users\Admin\AppData\Local\Temp\550160d122f85c9502a7a8e219dc68f3.exe
"C:\Users\Admin\AppData\Local\Temp\550160d122f85c9502a7a8e219dc68f3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1276

C:\Users\Admin\AppData\Local\Temp\550160d122f85c9502a7a8e219dc68f3.exe
"C:\Users\Admin\AppData\Local\Temp\550160d122f85c9502a7a8e219dc68f3.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:468

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsyBE52.tmp\ufmiumavkec.dll
MD5
0949bcc657e010888cdc627c08896169

SHA1
fb81029a2b6e8707fb5d6459c8e783c15c1a091f

SHA256
c5ba669697ae91226ac5792c63335ca8c7c33ee0d1431dc4b21c7d27b8a105a3

SHA512
bd061c768b7aeba5f12a91a3f74d1f02f8ce3d11294238708baf60bd7aba8349b6eb2dc8e41073bbe4669f0db70cbf5910603f55f8fb738824d28e8adb22dc49

Download Submit
memory/468-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/468-57-0x0000000000820000-0x0000000000B23000-memory.dmp

Filesize
3.0MB

Download
memory/1276-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing