xloader | c5ccdeea44050d8be9cf04b42ba6336dfd81e4a930ec6cd916f5f4e3a5f713bb

General

Target

196ef716e51eb90f7ffcfd2219ce1d5e.exe
Size

253KB
MD5

196ef716e51eb90f7ffcfd2219ce1d5e
SHA1

3c5d438cb3dee2b0474ea45be67069db184e26bb
SHA256

c5ccdeea44050d8be9cf04b42ba6336dfd81e4a930ec6cd916f5f4e3a5f713bb
SHA512

e303bd36a6cd409bf146b0716a52c50ab5069b3dd513303a8c63c1494013450e5a84ee0bf7eb5d7396946080f57ef08275e09326bc2bd3fc80f94f911e872759

Score

10^/10

xloader m0np loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

m0np

C2

http://www.devmedicalcentre.com/m0np/

Decoy

gruppovimar.com

seniordatingtv.com

pinpinyouqian.website

retreatreflectreplenish.com

baby-handmade.store

econsupplies.com

helloaustinpodcast.com

europe-lodging.com

ferahanaokulu.com

thehomeinspo.com

rawhoneytnpasumo6.xyz

tyckasei.quest

scissorsandbuffer.com

jatinvestmentsmaldives.com

softandcute.store

afuturemakerspromotions.online

leonsigntech.com

havetheshortscovered.com

cvkf.email

iplyyu.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/8-115-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/8-116-0x000000000041D450-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

196ef716e51eb90f7ffcfd2219ce1d5e.exe

pid process

1000 196ef716e51eb90f7ffcfd2219ce1d5e.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

196ef716e51eb90f7ffcfd2219ce1d5e.exe

description pid process target process

PID 1000 set thread context of 8 1000 196ef716e51eb90f7ffcfd2219ce1d5e.exe 196ef716e51eb90f7ffcfd2219ce1d5e.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

196ef716e51eb90f7ffcfd2219ce1d5e.exe

pid process

8 196ef716e51eb90f7ffcfd2219ce1d5e.exe
8 196ef716e51eb90f7ffcfd2219ce1d5e.exe

pid	process
1000	196ef716e51eb90f7ffcfd2219ce1d5e.exe

description	pid	process	target process
PID 1000 set thread context of 8	1000	196ef716e51eb90f7ffcfd2219ce1d5e.exe	196ef716e51eb90f7ffcfd2219ce1d5e.exe

pid	process
8	196ef716e51eb90f7ffcfd2219ce1d5e.exe
8	196ef716e51eb90f7ffcfd2219ce1d5e.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

196ef716e51eb90f7ffcfd2219ce1d5e.exe

description	pid	process	target process
PID 1000 wrote to memory of 8	1000	196ef716e51eb90f7ffcfd2219ce1d5e.exe	196ef716e51eb90f7ffcfd2219ce1d5e.exe
PID 1000 wrote to memory of 8	1000	196ef716e51eb90f7ffcfd2219ce1d5e.exe	196ef716e51eb90f7ffcfd2219ce1d5e.exe
PID 1000 wrote to memory of 8	1000	196ef716e51eb90f7ffcfd2219ce1d5e.exe	196ef716e51eb90f7ffcfd2219ce1d5e.exe
PID 1000 wrote to memory of 8	1000	196ef716e51eb90f7ffcfd2219ce1d5e.exe	196ef716e51eb90f7ffcfd2219ce1d5e.exe
PID 1000 wrote to memory of 8	1000	196ef716e51eb90f7ffcfd2219ce1d5e.exe	196ef716e51eb90f7ffcfd2219ce1d5e.exe
PID 1000 wrote to memory of 8	1000	196ef716e51eb90f7ffcfd2219ce1d5e.exe	196ef716e51eb90f7ffcfd2219ce1d5e.exe

C:\Users\Admin\AppData\Local\Temp\196ef716e51eb90f7ffcfd2219ce1d5e.exe
"C:\Users\Admin\AppData\Local\Temp\196ef716e51eb90f7ffcfd2219ce1d5e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1000

C:\Users\Admin\AppData\Local\Temp\196ef716e51eb90f7ffcfd2219ce1d5e.exe
"C:\Users\Admin\AppData\Local\Temp\196ef716e51eb90f7ffcfd2219ce1d5e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:8

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsh6974.tmp\wkpnpsjabyz.dll
MD5
cceb1c08032a04804191f34f7e070d5d

SHA1
7a6628b4b164874e61a034b17b669631dc3d7eb7

SHA256
eed96b31d0af300135ddd50ba8274b31d7902564bcb5c84224e5d1b2e357aaae

SHA512
e5ac48d0d422dc53133c15a1e8029cdf500186096b253e9893568410a20dfe25301e897db2b1cf902e2d1c85cde0309b1e4ac2c9b7cdeed5c41f1af472c23467

Download Submit
memory/8-115-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/8-116-0x000000000041D450-mapping.dmp

Download
memory/8-117-0x0000000000970000-0x0000000000C90000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing