xloader | 7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135

General

Target

7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe
Size

248KB
MD5

8dea3dfc88c81629eda9299c7031ed9e
SHA1

14cb4a4e1d5ca4a715a06df641933f7d50cd40b6
SHA256

7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135
SHA512

4f688839482e354bd6b4a622a3464c19b6f92cb2500b5b9f8687e209324efa415cb1e8ae56031a5144b445176c23a638cb580f43accdb462278990ada12d9f53

Score

10^/10

xloader u6vb loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

u6vb

Decoy

blendedmatter.com

piquinmarketing.com

dubkirelax.online

optimumotoaksesuar.com

bendisle.com

islamicgeometricpatterns.net

cheesebox.online

lh-coaching.com

buildingmaterial.info

backwoods72.com

goodtreetee.com

zknqqpvsypx.mobi

phukienstreaming.com

turkistick.com

cbd-shop-portugal.com

imherllc.com

krallechols.quest

ttmmb.com

pornmodelsworld.com

weakyummy.space

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1908-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe

pid process

2492 7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe

pid	process
2492	7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe

description	pid	process	target process
PID 2492 set thread context of 1908	2492	7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe	7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe

pid	process
1908	7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe
1908	7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe

description	pid	process	target process
PID 2492 wrote to memory of 1908	2492	7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe	7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe
PID 2492 wrote to memory of 1908	2492	7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe	7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe
PID 2492 wrote to memory of 1908	2492	7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe	7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe
PID 2492 wrote to memory of 1908	2492	7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe	7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe
PID 2492 wrote to memory of 1908	2492	7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe	7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe
PID 2492 wrote to memory of 1908	2492	7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe	7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe

C:\Users\Admin\AppData\Local\Temp\7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe
"C:\Users\Admin\AppData\Local\Temp\7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2492

C:\Users\Admin\AppData\Local\Temp\7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe
"C:\Users\Admin\AppData\Local\Temp\7bc209b35e0f0838c03f3a67be9e3f362a440ad2c8a3434dd52c4a16c4a72135.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1908

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsfDDA1.tmp\bekoa.dll
MD5
d4cea9ae27fa5d8fbb99e6bd3f62902a

SHA1
e3579b380f95afa22f7d60ce23cd3cda3bc94b90

SHA256
4a9316fabebef3467c9229c81238cbbb0bcf784c95de8e1c69b3e7d75ebc0916

SHA512
246b5e816f39e8628f00142a820f00ef779e93cbec64b379f5a8049a81b4408122596b88c9c37d4544dc5440d8aaac8f6633312bbb9aa7a6ba22c2e19e96a57a

Download Submit
memory/1908-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1908-117-0x00000000009D0000-0x0000000000CF0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads