xloader | cf3038247c7a2a5779f655fdf594bdad56b22d198b6edb1c3197b84d9c4f153a

General

Target

f2afb3a86d4b205705b0ec883e969f39.exe
Size

256KB
MD5

f2afb3a86d4b205705b0ec883e969f39
SHA1

edb2e066091b33f278e45d77c2c5fa0d0f2f360d
SHA256

cf3038247c7a2a5779f655fdf594bdad56b22d198b6edb1c3197b84d9c4f153a
SHA512

0a7e09bbdfb44b66916646bfb3c464911fcbc79eb521354406c69dfb93cd0c6ea21b0558c178cb7cfb45071589824cbebcc899ffa05c3cef8be28006dc4f372f

Score

10^/10

xloader m0np loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

m0np

C2

http://www.devmedicalcentre.com/m0np/

Decoy

gruppovimar.com

seniordatingtv.com

pinpinyouqian.website

retreatreflectreplenish.com

baby-handmade.store

econsupplies.com

helloaustinpodcast.com

europe-lodging.com

ferahanaokulu.com

thehomeinspo.com

rawhoneytnpasumo6.xyz

tyckasei.quest

scissorsandbuffer.com

jatinvestmentsmaldives.com

softandcute.store

afuturemakerspromotions.online

leonsigntech.com

havetheshortscovered.com

cvkf.email

iplyyu.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/864-115-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/864-116-0x000000000041D450-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

f2afb3a86d4b205705b0ec883e969f39.exe

pid process

636 f2afb3a86d4b205705b0ec883e969f39.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

f2afb3a86d4b205705b0ec883e969f39.exe

description pid process target process

PID 636 set thread context of 864 636 f2afb3a86d4b205705b0ec883e969f39.exe f2afb3a86d4b205705b0ec883e969f39.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f2afb3a86d4b205705b0ec883e969f39.exe

pid process

864 f2afb3a86d4b205705b0ec883e969f39.exe
864 f2afb3a86d4b205705b0ec883e969f39.exe

pid	process
636	f2afb3a86d4b205705b0ec883e969f39.exe

description	pid	process	target process
PID 636 set thread context of 864	636	f2afb3a86d4b205705b0ec883e969f39.exe	f2afb3a86d4b205705b0ec883e969f39.exe

pid	process
864	f2afb3a86d4b205705b0ec883e969f39.exe
864	f2afb3a86d4b205705b0ec883e969f39.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f2afb3a86d4b205705b0ec883e969f39.exe

description	pid	process	target process
PID 636 wrote to memory of 864	636	f2afb3a86d4b205705b0ec883e969f39.exe	f2afb3a86d4b205705b0ec883e969f39.exe
PID 636 wrote to memory of 864	636	f2afb3a86d4b205705b0ec883e969f39.exe	f2afb3a86d4b205705b0ec883e969f39.exe
PID 636 wrote to memory of 864	636	f2afb3a86d4b205705b0ec883e969f39.exe	f2afb3a86d4b205705b0ec883e969f39.exe
PID 636 wrote to memory of 864	636	f2afb3a86d4b205705b0ec883e969f39.exe	f2afb3a86d4b205705b0ec883e969f39.exe
PID 636 wrote to memory of 864	636	f2afb3a86d4b205705b0ec883e969f39.exe	f2afb3a86d4b205705b0ec883e969f39.exe
PID 636 wrote to memory of 864	636	f2afb3a86d4b205705b0ec883e969f39.exe	f2afb3a86d4b205705b0ec883e969f39.exe

C:\Users\Admin\AppData\Local\Temp\f2afb3a86d4b205705b0ec883e969f39.exe
"C:\Users\Admin\AppData\Local\Temp\f2afb3a86d4b205705b0ec883e969f39.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:636

C:\Users\Admin\AppData\Local\Temp\f2afb3a86d4b205705b0ec883e969f39.exe
"C:\Users\Admin\AppData\Local\Temp\f2afb3a86d4b205705b0ec883e969f39.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:864

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsb8D48.tmp\scwtnv.dll
MD5
844abf1b6643336b6e55f1fc4f7fedf2

SHA1
e23d3aeab06c84bb9b4c7477bf52e92b6f9bd556

SHA256
5bf2cb1e36454321595cf5a7304254e5968690b92a7e27e5b519db0c2dc04e5f

SHA512
d9a58d387829148574eae6f82738c2724b33e2425803e0ed2b623cbf7bbc2436b05c7e9eeeca4cda2ddbb1d73f2f2daf6f2eb73eb48278bd9b7bcfcd3172075f

Download Submit
memory/864-115-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/864-116-0x000000000041D450-mapping.dmp

Download
memory/864-117-0x00000000009B0000-0x0000000000CD0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing