xloader | 6dcb58ae937b9194609ef51a11f945abb7b82d9f10e032bbef2fda12ee96e6db

General

Target

ff766cdd10083147250eabfcaa76bebb.exe
Size

572KB
MD5

ff766cdd10083147250eabfcaa76bebb
SHA1

936815953ebeb2a771b03d86923079c01d2eb7f9
SHA256

6dcb58ae937b9194609ef51a11f945abb7b82d9f10e032bbef2fda12ee96e6db
SHA512

bdf81fdd836b74762bc22d522c9e6a2da73923a62355395472f8d9cf781bcc1fb8da7a6a165ba834ce18a913753e3463b4f9380e67a2cc136db0b2afcf3adac3

Score

10^/10

xloader r87g loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

r87g

Decoy

gzjyjzsj.com

rapibest.com

affordablebathroomsbyfrank.net

roboruben.com

xn--dlisucr-byag.com

encoreasso.com

piscire.com

dixiebusybee.com

newrome.xyz

sunshinejon.com

glacierforfcs.xyz

borhanmarket.com

tous-des-cons.club

hsfstea.com

spiniform.info

vaicomfibra.com

shinigami.xyz

kryptoindia.com

listentoappetite.com

securepplpay.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/892-66-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/892-67-0x000000000041D480-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

ff766cdd10083147250eabfcaa76bebb.exe

description pid process target process

PID 1580 set thread context of 892 1580 ff766cdd10083147250eabfcaa76bebb.exe ff766cdd10083147250eabfcaa76bebb.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1096 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ff766cdd10083147250eabfcaa76bebb.exepowershell.exe

pid process

892 ff766cdd10083147250eabfcaa76bebb.exe
2000 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2000 powershell.exe

description	pid	process	target process
PID 1580 set thread context of 892	1580	ff766cdd10083147250eabfcaa76bebb.exe	ff766cdd10083147250eabfcaa76bebb.exe

pid	process
1096	schtasks.exe

pid	process
892	ff766cdd10083147250eabfcaa76bebb.exe
2000	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2000	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

ff766cdd10083147250eabfcaa76bebb.exe

description	pid	process	target process
PID 1580 wrote to memory of 2000	1580	ff766cdd10083147250eabfcaa76bebb.exe	powershell.exe
PID 1580 wrote to memory of 2000	1580	ff766cdd10083147250eabfcaa76bebb.exe	powershell.exe
PID 1580 wrote to memory of 2000	1580	ff766cdd10083147250eabfcaa76bebb.exe	powershell.exe
PID 1580 wrote to memory of 2000	1580	ff766cdd10083147250eabfcaa76bebb.exe	powershell.exe
PID 1580 wrote to memory of 1096	1580	ff766cdd10083147250eabfcaa76bebb.exe	schtasks.exe
PID 1580 wrote to memory of 1096	1580	ff766cdd10083147250eabfcaa76bebb.exe	schtasks.exe
PID 1580 wrote to memory of 1096	1580	ff766cdd10083147250eabfcaa76bebb.exe	schtasks.exe
PID 1580 wrote to memory of 1096	1580	ff766cdd10083147250eabfcaa76bebb.exe	schtasks.exe
PID 1580 wrote to memory of 892	1580	ff766cdd10083147250eabfcaa76bebb.exe	ff766cdd10083147250eabfcaa76bebb.exe
PID 1580 wrote to memory of 892	1580	ff766cdd10083147250eabfcaa76bebb.exe	ff766cdd10083147250eabfcaa76bebb.exe
PID 1580 wrote to memory of 892	1580	ff766cdd10083147250eabfcaa76bebb.exe	ff766cdd10083147250eabfcaa76bebb.exe
PID 1580 wrote to memory of 892	1580	ff766cdd10083147250eabfcaa76bebb.exe	ff766cdd10083147250eabfcaa76bebb.exe
PID 1580 wrote to memory of 892	1580	ff766cdd10083147250eabfcaa76bebb.exe	ff766cdd10083147250eabfcaa76bebb.exe
PID 1580 wrote to memory of 892	1580	ff766cdd10083147250eabfcaa76bebb.exe	ff766cdd10083147250eabfcaa76bebb.exe
PID 1580 wrote to memory of 892	1580	ff766cdd10083147250eabfcaa76bebb.exe	ff766cdd10083147250eabfcaa76bebb.exe

C:\Users\Admin\AppData\Local\Temp\ff766cdd10083147250eabfcaa76bebb.exe
"C:\Users\Admin\AppData\Local\Temp\ff766cdd10083147250eabfcaa76bebb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nofaYQfZLH.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nofaYQfZLH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3B9B.tmp"
2⤵
- Creates scheduled task(s)
PID:1096

C:\Users\Admin\AppData\Local\Temp\ff766cdd10083147250eabfcaa76bebb.exe
"C:\Users\Admin\AppData\Local\Temp\ff766cdd10083147250eabfcaa76bebb.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:892

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3B9B.tmp
Filesize
1KB

MD5
717e1cc6d51c2b61d75fdd33b784fb43

SHA1
c7231fe9f78a161c3fde1aec654cd0402e35d6b8

SHA256
8ba214f251ca6259f4955ebe5bc4255a11f873446565915c9aa0232da0563819

SHA512
4361b64383f36b784e549dfbefc359b61c226bd7711950da1e848801b392b7bcf76f7d058497a7ce7668628e561a7c4fdc2e247e7c92225806a3fbd9d0fbc67b

Download Submit
memory/892-64-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/892-63-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/892-66-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/892-67-0x000000000041D480-mapping.dmp

Download
memory/892-68-0x0000000000860000-0x0000000000B63000-memory.dmp

Filesize
3.0MB

Download
memory/1096-60-0x0000000000000000-mapping.dmp

Download
memory/1580-56-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/1580-57-0x0000000007E10000-0x0000000007E82000-memory.dmp

Filesize
456KB

Download
memory/1580-55-0x0000000076811000-0x0000000076813000-memory.dmp

Filesize
8KB

Download
memory/1580-62-0x0000000004C00000-0x0000000004C30000-memory.dmp

Filesize
192KB

Download
memory/1580-54-0x0000000000F50000-0x0000000000FE2000-memory.dmp

Filesize
584KB

Download
memory/2000-58-0x0000000000000000-mapping.dmp

Download
memory/2000-69-0x000000006EBF0000-0x000000006F19B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads