xloader | 55f9aca129149b9bfd4e9685cf1e52b394dda7b2a47a3f989e46f12e5c306907

General

Target

55f9aca129149b9bfd4e9685cf1e52b394dda7b2a47a3f989e46f12e5c306907.exe
Size

655KB
MD5

52c7af6bc13670eb0b4b830d4f60fd7b
SHA1

b6d3c5f7f912ef524dc7e2679a6e205a0fb88b13
SHA256

55f9aca129149b9bfd4e9685cf1e52b394dda7b2a47a3f989e46f12e5c306907
SHA512

6f6a0482962d39e3bd5fedf8c3db14607fc0cce81b544df5578aa8f408a18c106b58c5d8b7c8fdd5e8cafac30477a892cd3203cb452fd321d8e2397baa850bae

Score

10^/10

xloader o8g5 loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

o8g5

Decoy

janeyelizarobertson.online

skachat-mp3.com

teamugoldzulu.com

qizuibashe.com

futuregainz.net

deedlife.com

findersguilde.com

memountainbikeadventures.com

carflagsmagnets.com

queenofheartsshop.com

jematai.com

adriannawilleford.com

dryfamwines.com

capitalsorted.com

runtaoyan.com

1833sell911.com

ysh9006.com

fouracrefoods.com

greenfieldjack.net

jokerjackpot888.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/316-65-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/316-70-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1632-75-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Executes dropped EXE 2 IoCs

Processes:

ffgnb.exed11bbh6a.exe

pid process

1132 ffgnb.exe
316 d11bbh6a.exe
Loads dropped DLL 2 IoCs

Processes:

55f9aca129149b9bfd4e9685cf1e52b394dda7b2a47a3f989e46f12e5c306907.exeffgnb.exe

pid process

308 55f9aca129149b9bfd4e9685cf1e52b394dda7b2a47a3f989e46f12e5c306907.exe
1132 ffgnb.exe

pid	process
308	55f9aca129149b9bfd4e9685cf1e52b394dda7b2a47a3f989e46f12e5c306907.exe
1132	ffgnb.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

ffgnb.exed11bbh6a.exewininit.exe

description	pid	process	target process
PID 1132 set thread context of 316	1132	ffgnb.exe	d11bbh6a.exe
PID 316 set thread context of 1260	316	d11bbh6a.exe	Explorer.EXE
PID 1632 set thread context of 1260	1632	wininit.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

ffgnb.exed11bbh6a.exewininit.exe

pid	process
1132	ffgnb.exe
1132	ffgnb.exe
1132	ffgnb.exe
1132	ffgnb.exe
316	d11bbh6a.exe
316	d11bbh6a.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe
1632	wininit.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

ffgnb.exed11bbh6a.exewininit.exe

pid process

1132 ffgnb.exe
316 d11bbh6a.exe
316 d11bbh6a.exe
316 d11bbh6a.exe
1632 wininit.exe
1632 wininit.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

d11bbh6a.exewininit.exe

description pid process

Token: SeDebugPrivilege 316 d11bbh6a.exe
Token: SeDebugPrivilege 1632 wininit.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1260 Explorer.EXE
1260 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1260 Explorer.EXE
1260 Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	316	d11bbh6a.exe
Token: SeDebugPrivilege	1632	wininit.exe

pid	process
1260	Explorer.EXE
1260	Explorer.EXE

pid	process
1260	Explorer.EXE
1260	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

55f9aca129149b9bfd4e9685cf1e52b394dda7b2a47a3f989e46f12e5c306907.exeffgnb.exeExplorer.EXEwininit.exe

description	pid	process	target process
PID 308 wrote to memory of 1132	308	55f9aca129149b9bfd4e9685cf1e52b394dda7b2a47a3f989e46f12e5c306907.exe	ffgnb.exe
PID 308 wrote to memory of 1132	308	55f9aca129149b9bfd4e9685cf1e52b394dda7b2a47a3f989e46f12e5c306907.exe	ffgnb.exe
PID 308 wrote to memory of 1132	308	55f9aca129149b9bfd4e9685cf1e52b394dda7b2a47a3f989e46f12e5c306907.exe	ffgnb.exe
PID 308 wrote to memory of 1132	308	55f9aca129149b9bfd4e9685cf1e52b394dda7b2a47a3f989e46f12e5c306907.exe	ffgnb.exe
PID 1132 wrote to memory of 316	1132	ffgnb.exe	d11bbh6a.exe
PID 1132 wrote to memory of 316	1132	ffgnb.exe	d11bbh6a.exe
PID 1132 wrote to memory of 316	1132	ffgnb.exe	d11bbh6a.exe
PID 1132 wrote to memory of 316	1132	ffgnb.exe	d11bbh6a.exe
PID 1132 wrote to memory of 316	1132	ffgnb.exe	d11bbh6a.exe
PID 1260 wrote to memory of 1632	1260	Explorer.EXE	wininit.exe
PID 1260 wrote to memory of 1632	1260	Explorer.EXE	wininit.exe
PID 1260 wrote to memory of 1632	1260	Explorer.EXE	wininit.exe
PID 1260 wrote to memory of 1632	1260	Explorer.EXE	wininit.exe
PID 1632 wrote to memory of 1748	1632	wininit.exe	cmd.exe
PID 1632 wrote to memory of 1748	1632	wininit.exe	cmd.exe
PID 1632 wrote to memory of 1748	1632	wininit.exe	cmd.exe
PID 1632 wrote to memory of 1748	1632	wininit.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1260

C:\Users\Admin\AppData\Local\Temp\55f9aca129149b9bfd4e9685cf1e52b394dda7b2a47a3f989e46f12e5c306907.exe
"C:\Users\Admin\AppData\Local\Temp\55f9aca129149b9bfd4e9685cf1e52b394dda7b2a47a3f989e46f12e5c306907.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:308

C:\Users\Admin\AppData\Local\Temp\ffgnb.exe
C:\Users\Admin\AppData\Local\Temp\ffgnb.exe C:\Users\Admin\AppData\Local\Temp\yttpclsuz.un
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1132

C:\Users\Admin\AppData\Local\Temp\d11bbh6a.exe
C:\Users\Admin\AppData\Local\Temp\ffgnb.exe C:\Users\Admin\AppData\Local\Temp\yttpclsuz.un
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:316

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1600

C:\Windows\SysWOW64\wininit.exe
"C:\Windows\SysWOW64\wininit.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\d11bbh6a.exe"
3⤵
PID:1748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d11bbh6a.exe
Filesize
872KB

MD5
535dd1329aef11bf4654b3270f026d5b

SHA1
9c84de0bde8333f852120ab40710545b3f799300

SHA256
b31445fc4b8803d1b7122a6563002cfe3e925ffd1fdc9b84fba6fc78f6a8b955

SHA512
a552e20a09a796a6e3e18dece308880069c958cf9136bb4fc3ee726d6bc9b2f8eddbcff06ff9f9ded4dd268f5d0f39d516ad42ecce6455a4bf5cf4f3cb4c4ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\d11bbh6a.exe
Filesize
872KB

MD5
535dd1329aef11bf4654b3270f026d5b

SHA1
9c84de0bde8333f852120ab40710545b3f799300

SHA256
b31445fc4b8803d1b7122a6563002cfe3e925ffd1fdc9b84fba6fc78f6a8b955

SHA512
a552e20a09a796a6e3e18dece308880069c958cf9136bb4fc3ee726d6bc9b2f8eddbcff06ff9f9ded4dd268f5d0f39d516ad42ecce6455a4bf5cf4f3cb4c4ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\ffgnb.exe
Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ffgnb.exe
Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lijkyiskt.wb
Filesize
161KB

MD5
435a073304527536e8a4bd1ae42f0758

SHA1
dd0d1940a2296bd300d4616950cdeccde490fc55

SHA256
cf42f72db083c9cb43c7a079fb78285204c5049dfee5d5500ee7af21d2750560

SHA512
35404d899ecd17156bf4abd40272efd56cd973408df79c5c6e3f37da0aefeae9b80188eff28ed8dbdeb2e408922da0007461c808db892e118f15a2d27e4283a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\yttpclsuz.un
Filesize
320KB

MD5
ca41cb20cdf27dc176635396d890b37a

SHA1
c0f0be5e238f5ae58fcfe48ce3293527bd446c5f

SHA256
414fa3842e5ef26c75893358286177912e5c288f7d3988fe524ff813ee90ad8f

SHA512
536e5841c351301f6774a61578bd0f57d9e91fdf5b345a1d56e1aed8f76c3dba7a63e07917de8bff9b0bdd3ca9cf9a259c1ca9902373873940143deeb29511c1

Download Submit
\Users\Admin\AppData\Local\Temp\d11bbh6a.exe
Filesize
872KB

MD5
535dd1329aef11bf4654b3270f026d5b

SHA1
9c84de0bde8333f852120ab40710545b3f799300

SHA256
b31445fc4b8803d1b7122a6563002cfe3e925ffd1fdc9b84fba6fc78f6a8b955

SHA512
a552e20a09a796a6e3e18dece308880069c958cf9136bb4fc3ee726d6bc9b2f8eddbcff06ff9f9ded4dd268f5d0f39d516ad42ecce6455a4bf5cf4f3cb4c4ecc

Download Submit
\Users\Admin\AppData\Local\Temp\ffgnb.exe
Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
memory/308-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/316-66-0x0000000000BB0000-0x0000000000EB3000-memory.dmp

Filesize
3.0MB

Download
memory/316-70-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/316-67-0x00000000001A0000-0x00000000001B0000-memory.dmp

Filesize
64KB

Download
memory/316-63-0x000000000041D120-mapping.dmp

Download
memory/316-65-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1132-56-0x0000000000000000-mapping.dmp

Download
memory/1260-68-0x0000000004080000-0x0000000004167000-memory.dmp

Filesize
924KB

Download
memory/1260-77-0x0000000005E40000-0x0000000005F18000-memory.dmp

Filesize
864KB

Download
memory/1260-78-0x0000000005E40000-0x0000000005F18000-memory.dmp

Filesize
864KB

Download
memory/1632-69-0x0000000000000000-mapping.dmp

Download
memory/1632-73-0x0000000000F30000-0x0000000000F4A000-memory.dmp

Filesize
104KB

Download
memory/1632-74-0x00000000009C0000-0x0000000000CC3000-memory.dmp

Filesize
3.0MB

Download
memory/1632-75-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/1632-76-0x0000000000CD0000-0x0000000000D5F000-memory.dmp

Filesize
572KB

Download
memory/1748-72-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads