xloader | c5ccdeea44050d8be9cf04b42ba6336dfd81e4a930ec6cd916f5f4e3a5f713bb

General

Target

196ef716e51eb90f7ffcfd2219ce1d5e.exe
Size

253KB
MD5

196ef716e51eb90f7ffcfd2219ce1d5e
SHA1

3c5d438cb3dee2b0474ea45be67069db184e26bb
SHA256

c5ccdeea44050d8be9cf04b42ba6336dfd81e4a930ec6cd916f5f4e3a5f713bb
SHA512

e303bd36a6cd409bf146b0716a52c50ab5069b3dd513303a8c63c1494013450e5a84ee0bf7eb5d7396946080f57ef08275e09326bc2bd3fc80f94f911e872759

Score

10^/10

xloader m0np loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

m0np

C2

http://www.devmedicalcentre.com/m0np/

Decoy

gruppovimar.com

seniordatingtv.com

pinpinyouqian.website

retreatreflectreplenish.com

baby-handmade.store

econsupplies.com

helloaustinpodcast.com

europe-lodging.com

ferahanaokulu.com

thehomeinspo.com

rawhoneytnpasumo6.xyz

tyckasei.quest

scissorsandbuffer.com

jatinvestmentsmaldives.com

softandcute.store

afuturemakerspromotions.online

leonsigntech.com

havetheshortscovered.com

cvkf.email

iplyyu.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1836-62-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1836-63-0x000000000041D450-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

196ef716e51eb90f7ffcfd2219ce1d5e.exe

pid process

1660 196ef716e51eb90f7ffcfd2219ce1d5e.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

196ef716e51eb90f7ffcfd2219ce1d5e.exe

description pid process target process

PID 1660 set thread context of 1836 1660 196ef716e51eb90f7ffcfd2219ce1d5e.exe 196ef716e51eb90f7ffcfd2219ce1d5e.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

196ef716e51eb90f7ffcfd2219ce1d5e.exe

pid process

1836 196ef716e51eb90f7ffcfd2219ce1d5e.exe

pid	process
1660	196ef716e51eb90f7ffcfd2219ce1d5e.exe

description	pid	process	target process
PID 1660 set thread context of 1836	1660	196ef716e51eb90f7ffcfd2219ce1d5e.exe	196ef716e51eb90f7ffcfd2219ce1d5e.exe

pid	process
1836	196ef716e51eb90f7ffcfd2219ce1d5e.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

196ef716e51eb90f7ffcfd2219ce1d5e.exe

description	pid	process	target process
PID 1660 wrote to memory of 1836	1660	196ef716e51eb90f7ffcfd2219ce1d5e.exe	196ef716e51eb90f7ffcfd2219ce1d5e.exe
PID 1660 wrote to memory of 1836	1660	196ef716e51eb90f7ffcfd2219ce1d5e.exe	196ef716e51eb90f7ffcfd2219ce1d5e.exe
PID 1660 wrote to memory of 1836	1660	196ef716e51eb90f7ffcfd2219ce1d5e.exe	196ef716e51eb90f7ffcfd2219ce1d5e.exe
PID 1660 wrote to memory of 1836	1660	196ef716e51eb90f7ffcfd2219ce1d5e.exe	196ef716e51eb90f7ffcfd2219ce1d5e.exe
PID 1660 wrote to memory of 1836	1660	196ef716e51eb90f7ffcfd2219ce1d5e.exe	196ef716e51eb90f7ffcfd2219ce1d5e.exe
PID 1660 wrote to memory of 1836	1660	196ef716e51eb90f7ffcfd2219ce1d5e.exe	196ef716e51eb90f7ffcfd2219ce1d5e.exe
PID 1660 wrote to memory of 1836	1660	196ef716e51eb90f7ffcfd2219ce1d5e.exe	196ef716e51eb90f7ffcfd2219ce1d5e.exe

C:\Users\Admin\AppData\Local\Temp\196ef716e51eb90f7ffcfd2219ce1d5e.exe
"C:\Users\Admin\AppData\Local\Temp\196ef716e51eb90f7ffcfd2219ce1d5e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1660

C:\Users\Admin\AppData\Local\Temp\196ef716e51eb90f7ffcfd2219ce1d5e.exe
"C:\Users\Admin\AppData\Local\Temp\196ef716e51eb90f7ffcfd2219ce1d5e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1836

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsa931B.tmp\wkpnpsjabyz.dll
MD5
cceb1c08032a04804191f34f7e070d5d

SHA1
7a6628b4b164874e61a034b17b669631dc3d7eb7

SHA256
eed96b31d0af300135ddd50ba8274b31d7902564bcb5c84224e5d1b2e357aaae

SHA512
e5ac48d0d422dc53133c15a1e8029cdf500186096b253e9893568410a20dfe25301e897db2b1cf902e2d1c85cde0309b1e4ac2c9b7cdeed5c41f1af472c23467

Download Submit
memory/1660-60-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1836-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1836-63-0x000000000041D450-mapping.dmp

Download
memory/1836-64-0x0000000000820000-0x0000000000B23000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing