Overview

overview

10

Static

static

1

Owen.exe

windows7_x64

10

Owen.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Owen.exe
  • Size 205KB
  • Sample210629-4a6tzhcaaa
  • SHA256 228f0e866b6580e0799a21147d9fbf4d6e56a5b89b9b68dcb29ca4d15d18f484
  • MD5 SHA1 SHA512
Score
10/10
xloaderloaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.3

C2

  • http://www.forward.school/a8si/

Decoy

  • napabroadcastpark.com

  • investoner.com

  • thebevpaw.com

  • waresponse.com

  • wendydongdev.com

  • kashifaminjewellers.com

  • modernlegalistic.com

  • leafywords.com

  • thinkfitedu.com

  • scrapegoatcreatives.com

  • deckdesigns.net

  • relayba.com

  • 111lucky.net

  • pawpride.pet

  • exploring-essentials.com

  • tideimg.com

  • artyzenstudiosart.com

  • cloudrevolutionawards.com

  • youngstarfashion.com

  • universitetsplassen.com

Targets

    • Target
      Owen.exe
    • Size 205KB
    • SHA256 228f0e866b6580e0799a21147d9fbf4d6e56a5b89b9b68dcb29ca4d15d18f484
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks