xloader | 990a8fa7e96d2cd90b09ab39794df984bc153d0dcd390afbca19a42b689d4e7d

General

Target

62c72f781d7001dff6d747ee91e33e32.exe
Size

262KB
MD5

62c72f781d7001dff6d747ee91e33e32
SHA1

ed9fb1d769fd4655a335884d26875758fe67433c
SHA256

990a8fa7e96d2cd90b09ab39794df984bc153d0dcd390afbca19a42b689d4e7d
SHA512

2b4e491681ddeebbf0eadb0f86923cedd6bc22c168c33aaa0363069df317a6bf5bde74f614abc97dde35185aa8f1f8fd5c0340a4b4c509fdf3f1837bbfb6473d

Score

10^/10

xloader m0np loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

m0np

C2

http://www.devmedicalcentre.com/m0np/

Decoy

gruppovimar.com

seniordatingtv.com

pinpinyouqian.website

retreatreflectreplenish.com

baby-handmade.store

econsupplies.com

helloaustinpodcast.com

europe-lodging.com

ferahanaokulu.com

thehomeinspo.com

rawhoneytnpasumo6.xyz

tyckasei.quest

scissorsandbuffer.com

jatinvestmentsmaldives.com

softandcute.store

afuturemakerspromotions.online

leonsigntech.com

havetheshortscovered.com

cvkf.email

iplyyu.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2640-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/2640-117-0x000000000041D450-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

62c72f781d7001dff6d747ee91e33e32.exe

pid process

2396 62c72f781d7001dff6d747ee91e33e32.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

62c72f781d7001dff6d747ee91e33e32.exe

description pid process target process

PID 2396 set thread context of 2640 2396 62c72f781d7001dff6d747ee91e33e32.exe 62c72f781d7001dff6d747ee91e33e32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

62c72f781d7001dff6d747ee91e33e32.exe

pid process

2640 62c72f781d7001dff6d747ee91e33e32.exe
2640 62c72f781d7001dff6d747ee91e33e32.exe

pid	process
2396	62c72f781d7001dff6d747ee91e33e32.exe

description	pid	process	target process
PID 2396 set thread context of 2640	2396	62c72f781d7001dff6d747ee91e33e32.exe	62c72f781d7001dff6d747ee91e33e32.exe

pid	process
2640	62c72f781d7001dff6d747ee91e33e32.exe
2640	62c72f781d7001dff6d747ee91e33e32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

62c72f781d7001dff6d747ee91e33e32.exe

description	pid	process	target process
PID 2396 wrote to memory of 2640	2396	62c72f781d7001dff6d747ee91e33e32.exe	62c72f781d7001dff6d747ee91e33e32.exe
PID 2396 wrote to memory of 2640	2396	62c72f781d7001dff6d747ee91e33e32.exe	62c72f781d7001dff6d747ee91e33e32.exe
PID 2396 wrote to memory of 2640	2396	62c72f781d7001dff6d747ee91e33e32.exe	62c72f781d7001dff6d747ee91e33e32.exe
PID 2396 wrote to memory of 2640	2396	62c72f781d7001dff6d747ee91e33e32.exe	62c72f781d7001dff6d747ee91e33e32.exe
PID 2396 wrote to memory of 2640	2396	62c72f781d7001dff6d747ee91e33e32.exe	62c72f781d7001dff6d747ee91e33e32.exe
PID 2396 wrote to memory of 2640	2396	62c72f781d7001dff6d747ee91e33e32.exe	62c72f781d7001dff6d747ee91e33e32.exe

C:\Users\Admin\AppData\Local\Temp\62c72f781d7001dff6d747ee91e33e32.exe
"C:\Users\Admin\AppData\Local\Temp\62c72f781d7001dff6d747ee91e33e32.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2396

C:\Users\Admin\AppData\Local\Temp\62c72f781d7001dff6d747ee91e33e32.exe
"C:\Users\Admin\AppData\Local\Temp\62c72f781d7001dff6d747ee91e33e32.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2640

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsg96B9.tmp\ojcwnasg.dll
MD5
a1c31e0436d00eb00481b5c0f39fa849

SHA1
1c71dc6fb7b93c99722dba7deee53dda9e19f5a5

SHA256
856362062f444906aa7cce79dab2727d9fbcdfc3d6ac5241819c1586d3693f8b

SHA512
466bbf168192502b718eca1e83f5120e4b144f77754ac276b577ec7cddd30dd93c3a3465e1e6ff9db0884cf4c3ca9a62867a9522dd88f20cf93200be3287768b

Download Submit
memory/2640-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2640-117-0x000000000041D450-mapping.dmp

Download
memory/2640-118-0x00000000009E0000-0x0000000000D00000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing