xloader | 9f35e751b58fdca3b7156eba1bf2a56c88d3d5ce5e35de6b2797e6c8ba6ec0d8

General

Target

a3eddc5e0885b4be2b72e3e2f24eed7c.exe
Size

251KB
MD5

a3eddc5e0885b4be2b72e3e2f24eed7c
SHA1

a561c6eb59d66ac7d0a89b586fc38f1fd88d1623
SHA256

9f35e751b58fdca3b7156eba1bf2a56c88d3d5ce5e35de6b2797e6c8ba6ec0d8
SHA512

19b12ddc4c0979eeb15d13d230a5d72d97a0899414c6b2d5393ee119719dc2c7684beb7fccff8838a4b69951359808ff81b2a68e8111334eb53ba6d1fc4ec5a4

Score

10^/10

xloader u6vb loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

u6vb

Decoy

blendedmatter.com

piquinmarketing.com

dubkirelax.online

optimumotoaksesuar.com

bendisle.com

islamicgeometricpatterns.net

cheesebox.online

lh-coaching.com

buildingmaterial.info

backwoods72.com

goodtreetee.com

zknqqpvsypx.mobi

phukienstreaming.com

turkistick.com

cbd-shop-portugal.com

imherllc.com

krallechols.quest

ttmmb.com

pornmodelsworld.com

weakyummy.space

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2420-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

a3eddc5e0885b4be2b72e3e2f24eed7c.exe

pid process

2532 a3eddc5e0885b4be2b72e3e2f24eed7c.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

a3eddc5e0885b4be2b72e3e2f24eed7c.exe

description pid process target process

PID 2532 set thread context of 2420 2532 a3eddc5e0885b4be2b72e3e2f24eed7c.exe a3eddc5e0885b4be2b72e3e2f24eed7c.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a3eddc5e0885b4be2b72e3e2f24eed7c.exe

pid process

2420 a3eddc5e0885b4be2b72e3e2f24eed7c.exe
2420 a3eddc5e0885b4be2b72e3e2f24eed7c.exe

pid	process
2532	a3eddc5e0885b4be2b72e3e2f24eed7c.exe

description	pid	process	target process
PID 2532 set thread context of 2420	2532	a3eddc5e0885b4be2b72e3e2f24eed7c.exe	a3eddc5e0885b4be2b72e3e2f24eed7c.exe

pid	process
2420	a3eddc5e0885b4be2b72e3e2f24eed7c.exe
2420	a3eddc5e0885b4be2b72e3e2f24eed7c.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a3eddc5e0885b4be2b72e3e2f24eed7c.exe

description	pid	process	target process
PID 2532 wrote to memory of 2420	2532	a3eddc5e0885b4be2b72e3e2f24eed7c.exe	a3eddc5e0885b4be2b72e3e2f24eed7c.exe
PID 2532 wrote to memory of 2420	2532	a3eddc5e0885b4be2b72e3e2f24eed7c.exe	a3eddc5e0885b4be2b72e3e2f24eed7c.exe
PID 2532 wrote to memory of 2420	2532	a3eddc5e0885b4be2b72e3e2f24eed7c.exe	a3eddc5e0885b4be2b72e3e2f24eed7c.exe
PID 2532 wrote to memory of 2420	2532	a3eddc5e0885b4be2b72e3e2f24eed7c.exe	a3eddc5e0885b4be2b72e3e2f24eed7c.exe
PID 2532 wrote to memory of 2420	2532	a3eddc5e0885b4be2b72e3e2f24eed7c.exe	a3eddc5e0885b4be2b72e3e2f24eed7c.exe
PID 2532 wrote to memory of 2420	2532	a3eddc5e0885b4be2b72e3e2f24eed7c.exe	a3eddc5e0885b4be2b72e3e2f24eed7c.exe

C:\Users\Admin\AppData\Local\Temp\a3eddc5e0885b4be2b72e3e2f24eed7c.exe
"C:\Users\Admin\AppData\Local\Temp\a3eddc5e0885b4be2b72e3e2f24eed7c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2532

C:\Users\Admin\AppData\Local\Temp\a3eddc5e0885b4be2b72e3e2f24eed7c.exe
"C:\Users\Admin\AppData\Local\Temp\a3eddc5e0885b4be2b72e3e2f24eed7c.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2420

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsp279B.tmp\idwqocteck.dll
MD5
edf8a41b45e466e3f2c159c64ad7b302

SHA1
78c5b7e53469e1f10c504b06d78caa125a85a7e1

SHA256
9a02eb66227db973b5cdf911111ea2411b3c89b91c98dd50a20897c53a798842

SHA512
7ce1c7d4abeacc4f59da7928e09a1f3c494ded352643d359e10a1f6cc00667e9d9704ecc7a18e7a556b033b439136f09c310b08ddcb64e4cd58af804390ccf1b

Download Submit
memory/2420-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2420-117-0x0000000000A10000-0x0000000000D30000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing