xloader | b32448dbeec13e1eb23e55a57ffc06f9dfc8fd44687e19fc0be1c4fbabc10abb

General

Target

dfbd95b518ecc9178415c3b24078c94f.exe
Size

253KB
MD5

dfbd95b518ecc9178415c3b24078c94f
SHA1

6881c018ddf6fcbd775c92bb897967408f0f504a
SHA256

b32448dbeec13e1eb23e55a57ffc06f9dfc8fd44687e19fc0be1c4fbabc10abb
SHA512

981c786a7f8688574de78b1c722126456307e56d0ca6c22a1e06ff73dd9fcc13c94767caddcb61d0600e793cb9ef00b21f97e581949d194fbe00d65d7f2509db

Score

10^/10

xloader m0np loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

m0np

C2

http://www.devmedicalcentre.com/m0np/

Decoy

gruppovimar.com

seniordatingtv.com

pinpinyouqian.website

retreatreflectreplenish.com

baby-handmade.store

econsupplies.com

helloaustinpodcast.com

europe-lodging.com

ferahanaokulu.com

thehomeinspo.com

rawhoneytnpasumo6.xyz

tyckasei.quest

scissorsandbuffer.com

jatinvestmentsmaldives.com

softandcute.store

afuturemakerspromotions.online

leonsigntech.com

havetheshortscovered.com

cvkf.email

iplyyu.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1452-63-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

dfbd95b518ecc9178415c3b24078c94f.exe

pid process

1976 dfbd95b518ecc9178415c3b24078c94f.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

dfbd95b518ecc9178415c3b24078c94f.exe

description pid process target process

PID 1976 set thread context of 1452 1976 dfbd95b518ecc9178415c3b24078c94f.exe dfbd95b518ecc9178415c3b24078c94f.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

dfbd95b518ecc9178415c3b24078c94f.exe

pid process

1452 dfbd95b518ecc9178415c3b24078c94f.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

dfbd95b518ecc9178415c3b24078c94f.exe

pid process

1976 dfbd95b518ecc9178415c3b24078c94f.exe

pid	process
1976	dfbd95b518ecc9178415c3b24078c94f.exe

description	pid	process	target process
PID 1976 set thread context of 1452	1976	dfbd95b518ecc9178415c3b24078c94f.exe	dfbd95b518ecc9178415c3b24078c94f.exe

pid	process
1452	dfbd95b518ecc9178415c3b24078c94f.exe

pid	process
1976	dfbd95b518ecc9178415c3b24078c94f.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

dfbd95b518ecc9178415c3b24078c94f.exe

description	pid	process	target process
PID 1976 wrote to memory of 1452	1976	dfbd95b518ecc9178415c3b24078c94f.exe	dfbd95b518ecc9178415c3b24078c94f.exe
PID 1976 wrote to memory of 1452	1976	dfbd95b518ecc9178415c3b24078c94f.exe	dfbd95b518ecc9178415c3b24078c94f.exe
PID 1976 wrote to memory of 1452	1976	dfbd95b518ecc9178415c3b24078c94f.exe	dfbd95b518ecc9178415c3b24078c94f.exe
PID 1976 wrote to memory of 1452	1976	dfbd95b518ecc9178415c3b24078c94f.exe	dfbd95b518ecc9178415c3b24078c94f.exe
PID 1976 wrote to memory of 1452	1976	dfbd95b518ecc9178415c3b24078c94f.exe	dfbd95b518ecc9178415c3b24078c94f.exe

C:\Users\Admin\AppData\Local\Temp\dfbd95b518ecc9178415c3b24078c94f.exe
"C:\Users\Admin\AppData\Local\Temp\dfbd95b518ecc9178415c3b24078c94f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1976

C:\Users\Admin\AppData\Local\Temp\dfbd95b518ecc9178415c3b24078c94f.exe
"C:\Users\Admin\AppData\Local\Temp\dfbd95b518ecc9178415c3b24078c94f.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1452

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsaDCD7.tmp\gogxofveb.dll
MD5
5e0c4458aeaf4004eda52aef446624b7

SHA1
2c4e328afe87b6de681fc433978ce8e09ccd5a2d

SHA256
43ae5a5e3fd660e0b3b281a44d82ca2a651c126fc5ff8f540fb32145665b0b74

SHA512
f3b024fa981ff0548be4452195dd66cd5cd06135158175da7eb1a4ce0c62ec531e513fbc997bbc67c78ce444818a52223923f18418642badec7b63e0a41254d5

Download Submit
memory/1452-62-0x000000000041D450-mapping.dmp

Download
memory/1452-64-0x0000000000770000-0x0000000000A73000-memory.dmp

Filesize
3.0MB

Download
memory/1452-63-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1976-60-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing