xloader | 31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990

General

Target

31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe
Size

260KB
MD5

fbaece4205ad6b13817946a0bdf13900
SHA1

5a90df6971a60dc7f17bdd2f7ee35e041f3ee14b
SHA256

31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990
SHA512

3dea45a7d59261311cd4a27603b730e32dd29cb4679f762904c615aa09f2e099c536dd9892cda2de8714201411dc101e1dd73c3a76484127aa57bbca2e70751b

Score

10^/10

xloader m0np loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

m0np

C2

http://www.devmedicalcentre.com/m0np/

Decoy

gruppovimar.com

seniordatingtv.com

pinpinyouqian.website

retreatreflectreplenish.com

baby-handmade.store

econsupplies.com

helloaustinpodcast.com

europe-lodging.com

ferahanaokulu.com

thehomeinspo.com

rawhoneytnpasumo6.xyz

tyckasei.quest

scissorsandbuffer.com

jatinvestmentsmaldives.com

softandcute.store

afuturemakerspromotions.online

leonsigntech.com

havetheshortscovered.com

cvkf.email

iplyyu.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2304-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2304-117-0x000000000041D450-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe

pid process

2072 31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe

pid	process
2072	31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe

description	pid	process	target process
PID 2072 set thread context of 2304	2072	31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe	31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe

pid	process
2304	31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe
2304	31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe

description	pid	process	target process
PID 2072 wrote to memory of 2304	2072	31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe	31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe
PID 2072 wrote to memory of 2304	2072	31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe	31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe
PID 2072 wrote to memory of 2304	2072	31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe	31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe
PID 2072 wrote to memory of 2304	2072	31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe	31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe
PID 2072 wrote to memory of 2304	2072	31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe	31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe
PID 2072 wrote to memory of 2304	2072	31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe	31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe

C:\Users\Admin\AppData\Local\Temp\31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe
"C:\Users\Admin\AppData\Local\Temp\31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2072

C:\Users\Admin\AppData\Local\Temp\31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe
"C:\Users\Admin\AppData\Local\Temp\31accabae2032a0fda8dd449182167521360e258df6ebd2316130399d910e990.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2304

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsw8B4F.tmp\iwhlrzyfkva.dll
MD5
7bbc8a60fde970a12ab12018708b2014

SHA1
101c1e0c7ab4341db608895153628db9202fc05b

SHA256
20534b6c0ec991ba4aa2add53cee1f0c69344b2d3a5f3451595e2ffa335e123c

SHA512
91eb09c7636e880ec3f785ca8da558c32ee4bcf769b74f166eb542dfea9fd6dfc6514d274b4e5327cb554ef3e9a655526e30e374a86ff08b8d8ee2808c1d380e

Download Submit
memory/2304-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2304-117-0x000000000041D450-mapping.dmp

Download
memory/2304-118-0x0000000000B20000-0x0000000000E40000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads