xloader | 57db8a6dc112c8d4b4202ba07774edf9bf54fdafd6fe11bd8d0e7ae328fcc369

General

Target

Originalgoodsorder2022_196532012.exe
Size

310KB
MD5

e1c16d90f07bc1d1540256db01ee6be1
SHA1

0e3295b972ea3a2fb9f47e997f3aa694ece200bc
SHA256

57db8a6dc112c8d4b4202ba07774edf9bf54fdafd6fe11bd8d0e7ae328fcc369
SHA512

53b941e1348270d57d72bae84f0a23868e8e0b9c82a4d7209f62eb02b34ea14e9caf6da2171558f0d3464a4704eb9288a0bbbff4a62a90d9df74eaa59623f42b

Score

10^/10

xloader ssac loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ssac

Decoy

beautybybrin.com

oregemo.com

prospectoriq.com

blazermid.com

cloudnineloans.com

myyntisofta.com

filoupoils.com

web-solutiontnpasumo3.xyz

becbares.com

lines-hikkoshi.com

ohayouwww.com

writingdadsobituarywithdad.com

bridalbaes.com

jamshir.com

rangertots.com

dankbrobeans.com

titan111.com

uplearns.info

maxicashprokil.xyz

evc24.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3760-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

Originalgoodsorder2022_196532012.exe

pid process

3516 Originalgoodsorder2022_196532012.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Originalgoodsorder2022_196532012.exe

description pid process target process

PID 3516 set thread context of 3760 3516 Originalgoodsorder2022_196532012.exe Originalgoodsorder2022_196532012.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Originalgoodsorder2022_196532012.exe

pid process

3760 Originalgoodsorder2022_196532012.exe
3760 Originalgoodsorder2022_196532012.exe

pid	process
3516	Originalgoodsorder2022_196532012.exe

description	pid	process	target process
PID 3516 set thread context of 3760	3516	Originalgoodsorder2022_196532012.exe	Originalgoodsorder2022_196532012.exe

pid	process
3760	Originalgoodsorder2022_196532012.exe
3760	Originalgoodsorder2022_196532012.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Originalgoodsorder2022_196532012.exe

description	pid	process	target process
PID 3516 wrote to memory of 3760	3516	Originalgoodsorder2022_196532012.exe	Originalgoodsorder2022_196532012.exe
PID 3516 wrote to memory of 3760	3516	Originalgoodsorder2022_196532012.exe	Originalgoodsorder2022_196532012.exe
PID 3516 wrote to memory of 3760	3516	Originalgoodsorder2022_196532012.exe	Originalgoodsorder2022_196532012.exe
PID 3516 wrote to memory of 3760	3516	Originalgoodsorder2022_196532012.exe	Originalgoodsorder2022_196532012.exe
PID 3516 wrote to memory of 3760	3516	Originalgoodsorder2022_196532012.exe	Originalgoodsorder2022_196532012.exe
PID 3516 wrote to memory of 3760	3516	Originalgoodsorder2022_196532012.exe	Originalgoodsorder2022_196532012.exe

C:\Users\Admin\AppData\Local\Temp\Originalgoodsorder2022_196532012.exe
"C:\Users\Admin\AppData\Local\Temp\Originalgoodsorder2022_196532012.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3516

C:\Users\Admin\AppData\Local\Temp\Originalgoodsorder2022_196532012.exe
"C:\Users\Admin\AppData\Local\Temp\Originalgoodsorder2022_196532012.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3760

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsoA720.tmp\tbpstexz.dll
MD5
c079aa3b2f303eb957e92dba04b52248

SHA1
82ca7c55f6facfb1fd2abd24ebf382bae6fe2b43

SHA256
b0345a47cd68f91827d7b4eb8ab3c12cc73fa13690ceb78bb6912ead6c9062ed

SHA512
190988fa3d0167a4d6b24a6121594c3ac3119585be02b438260c960692c8b9d02a56ddd9319357fb3e4c47e212d0faa024d400a83b67c711a850b50a4996f7df

Download Submit
memory/3760-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3760-117-0x00000000009F0000-0x0000000000D10000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing