xloader | b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a

General

Target

b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe
Size

314KB
MD5

7b74e2dc26c5931e3a3103ed71d6bb06
SHA1

8201e9871601e4eefe5fa004a4dc670f7a57b9b6
SHA256

b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a
SHA512

ab93509d1bd7fcd7fce7eeace9d7e82f7747d3bcd1fe6b70c207aa5fa9dd2c80124167ce1465d35382dd5a842b3e734f6a550d608ab077e1e297e5befccfcc14
SSDEEP

6144:pqjIlffgjQfRH8zoM6Zp8ucm9FP1Uv/NmgrUU3ub6E69MDt:AKgMfR7v8zmj1WFmBBeeR

Score

10^/10

xloader a0ce loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

a0ce

Decoy

mccordsvillefinehomes.com

alibaba-provader.space

clearpatron.com

chajmf.com

advaitatestdominio.com

nataliacuminale.com

homeremodelingokc.com

telecomcruz.com

thusspokelibraealus.com

xtr3cafe.com

kjfamilypropertyllc.com

sofakingwet.com

360ttzw.com

foodel-uk.com

bonedibangaliyana.com

atozcontractingmdmd.com

outreachrespectfully.com

betterworldtees.com

bookreservationz.net

fallguysmobel.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/948-60-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 2 IoCs

Processes:

b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe

pid	process
1884	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe
1884	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe

description	pid	process	target process
PID 1884 set thread context of 948	1884	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exeb80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe

pid	process
1884	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe
1884	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe
1884	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe
1884	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe
948	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe

pid process

1884 b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe

description	pid	process	target process
PID 1884 wrote to memory of 948	1884	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe
PID 1884 wrote to memory of 948	1884	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe
PID 1884 wrote to memory of 948	1884	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe
PID 1884 wrote to memory of 948	1884	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe
PID 1884 wrote to memory of 948	1884	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe	b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe

C:\Users\Admin\AppData\Local\Temp\b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe
"C:\Users\Admin\AppData\Local\Temp\b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1884

C:\Users\Admin\AppData\Local\Temp\b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe
"C:\Users\Admin\AppData\Local\Temp\b80b8ce41c6c6b67a0683a7c400a24c2270981bdec1b85f4111a0f5a5af3467a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:948

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nstEFAE.tmp\System.dll
Filesize
11KB

MD5
fccff8cb7a1067e23fd2e2b63971a8e1

SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91

SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

Download Submit
\Users\Admin\AppData\Local\Temp\tskhm1.dll
Filesize
11KB

MD5
e733aa5f95a83d5734ed63717bcdf7f4

SHA1
b69365aea219d7c3bdb6199c5fddd378fbc57af3

SHA256
dcf63aae9ea6e283ba12522ffb94b357f852a9f243069df9a7806866fd22fa52

SHA512
29ecb1a644ec2ad626e574ac161c77463b9684669350bc77349bf69c21e4ce6b5afb683329401aa47b0518e95b38042ae7ad7bb0576392946c3ee4431d2f3aa2

Download Submit
memory/948-57-0x000000000041D090-mapping.dmp

Download
memory/948-59-0x0000000000740000-0x0000000000A43000-memory.dmp

Filesize
3.0MB

Download
memory/948-60-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1884-54-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1884-58-0x0000000074DC0000-0x0000000074DC7000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads