xloader | ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da

General

Target

ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe
Size

412KB
MD5

a75c88bdafcead6c2096d01dc8f2f052
SHA1

d36d981a34f591eada1df8ea230bbfbdcbd6bf97
SHA256

ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da
SHA512

b8d3d14112e5910d906c74c63d0208ac02e8e29b230d92bef1d7c6098a65c0b7660841a5fcefebaf96edf969cdeda62282cd642d56c63fe711a23ea0112edd41

Score

10^/10

xloader nt3f loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

nt3f

Decoy

tricyclee.com

kxsw999.com

wisteria-pavilion.com

bellaclancy.com

promissioskincare.com

hzy001.xyz

checkouthomehd.com

soladere.com

point4sales.com

socalmafia.com

libertadysarmiento.online

nftthirty.com

digitalgoldcryptostock.net

tulekiloscaird.com

austinfishandchicken.com

wlxxch.com

mgav51.xyz

landbanking.global

saprove.com

babyfaces.skin

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2204-119-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe

pid process

2712 ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe

pid	process
2712	ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe

description	pid	process	target process
PID 2712 set thread context of 2204	2712	ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe	ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe

pid	process
2204	ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe
2204	ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe

description	pid	process	target process
PID 2712 wrote to memory of 2204	2712	ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe	ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe
PID 2712 wrote to memory of 2204	2712	ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe	ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe
PID 2712 wrote to memory of 2204	2712	ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe	ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe
PID 2712 wrote to memory of 2204	2712	ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe	ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe
PID 2712 wrote to memory of 2204	2712	ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe	ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe
PID 2712 wrote to memory of 2204	2712	ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe	ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe

C:\Users\Admin\AppData\Local\Temp\ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe
"C:\Users\Admin\AppData\Local\Temp\ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2712

C:\Users\Admin\AppData\Local\Temp\ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe
"C:\Users\Admin\AppData\Local\Temp\ba46838d8445539ef9360355459abfdf8d0932d80f26cd8682fbaf2a236461da.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2204

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nslD2E3.tmp\pxitlcdz.dll
MD5
606d2bcc416fc37c03e554be57b99395

SHA1
1ef604a21f62cbd9039b5b7dec49d74fcc69aa4c

SHA256
11b98384fa90009836cbbf1798b535759bb166278dd0e855dcef2e851720832b

SHA512
63cea78cece3875a839ca62e82db4d9caef7071af6964421f4cfbcb18299c1a7636c69d759f8e134ad74ab968f98be15b6939a660e3299417276a13dcae5ddde

Download Submit
memory/2204-119-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2204-120-0x0000000000A30000-0x0000000000D50000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads