xloader | 64e3a0f2298f21833eb7a9c51aa0b2b8d3354bdcefb0156bb34371e3163d8b3d

General

Target

f9d0f03aba5378393fe83fa8e473b89a.exe
Size

493KB
MD5

f9d0f03aba5378393fe83fa8e473b89a
SHA1

174def16b7a286eeb3f97f68817ab393414ac5fc
SHA256

64e3a0f2298f21833eb7a9c51aa0b2b8d3354bdcefb0156bb34371e3163d8b3d
SHA512

c2b21c01fe2af50c3358e61d7a81cf4889fe34b222ee555a487e93f73f57f8392a3947ab3572f10c2df3b7444e4b3b2f520c6bae8effb50bf1014ca0a40bcb3b

Score

10^/10

xloader m0np loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

m0np

C2

http://www.devmedicalcentre.com/m0np/

Decoy

gruppovimar.com

seniordatingtv.com

pinpinyouqian.website

retreatreflectreplenish.com

baby-handmade.store

econsupplies.com

helloaustinpodcast.com

europe-lodging.com

ferahanaokulu.com

thehomeinspo.com

rawhoneytnpasumo6.xyz

tyckasei.quest

scissorsandbuffer.com

jatinvestmentsmaldives.com

softandcute.store

afuturemakerspromotions.online

leonsigntech.com

havetheshortscovered.com

cvkf.email

iplyyu.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1888-62-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1888-63-0x000000000041D450-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

f9d0f03aba5378393fe83fa8e473b89a.exe

pid process

1068 f9d0f03aba5378393fe83fa8e473b89a.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

f9d0f03aba5378393fe83fa8e473b89a.exe

description pid process target process

PID 1068 set thread context of 1888 1068 f9d0f03aba5378393fe83fa8e473b89a.exe f9d0f03aba5378393fe83fa8e473b89a.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f9d0f03aba5378393fe83fa8e473b89a.exe

pid process

1888 f9d0f03aba5378393fe83fa8e473b89a.exe

pid	process
1068	f9d0f03aba5378393fe83fa8e473b89a.exe

description	pid	process	target process
PID 1068 set thread context of 1888	1068	f9d0f03aba5378393fe83fa8e473b89a.exe	f9d0f03aba5378393fe83fa8e473b89a.exe

pid	process
1888	f9d0f03aba5378393fe83fa8e473b89a.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

f9d0f03aba5378393fe83fa8e473b89a.exe

description	pid	process	target process
PID 1068 wrote to memory of 1888	1068	f9d0f03aba5378393fe83fa8e473b89a.exe	f9d0f03aba5378393fe83fa8e473b89a.exe
PID 1068 wrote to memory of 1888	1068	f9d0f03aba5378393fe83fa8e473b89a.exe	f9d0f03aba5378393fe83fa8e473b89a.exe
PID 1068 wrote to memory of 1888	1068	f9d0f03aba5378393fe83fa8e473b89a.exe	f9d0f03aba5378393fe83fa8e473b89a.exe
PID 1068 wrote to memory of 1888	1068	f9d0f03aba5378393fe83fa8e473b89a.exe	f9d0f03aba5378393fe83fa8e473b89a.exe
PID 1068 wrote to memory of 1888	1068	f9d0f03aba5378393fe83fa8e473b89a.exe	f9d0f03aba5378393fe83fa8e473b89a.exe
PID 1068 wrote to memory of 1888	1068	f9d0f03aba5378393fe83fa8e473b89a.exe	f9d0f03aba5378393fe83fa8e473b89a.exe
PID 1068 wrote to memory of 1888	1068	f9d0f03aba5378393fe83fa8e473b89a.exe	f9d0f03aba5378393fe83fa8e473b89a.exe

C:\Users\Admin\AppData\Local\Temp\f9d0f03aba5378393fe83fa8e473b89a.exe
"C:\Users\Admin\AppData\Local\Temp\f9d0f03aba5378393fe83fa8e473b89a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1068

C:\Users\Admin\AppData\Local\Temp\f9d0f03aba5378393fe83fa8e473b89a.exe
"C:\Users\Admin\AppData\Local\Temp\f9d0f03aba5378393fe83fa8e473b89a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1888

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsqA747.tmp\vxzhefqohet.dll
MD5
5ce792c789b4f543dcd483328705b149

SHA1
def861f44b722e4f5f96e90aff6de12f3ff4427b

SHA256
b05b77c57fd3fef88f05f5a7d0013f80885e148217c3f38f56aedd342464a86c

SHA512
70623479ca68e2f420b9159e3e600fd3cc94fa07a67e6d21e859800bfe4211924fce2ccfd15376c2e9bc52af8893cb1d3c40a9a6cf126545c86267e1f69b0f43

Download Submit
memory/1068-60-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1888-62-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1888-63-0x000000000041D450-mapping.dmp

Download
memory/1888-64-0x0000000000740000-0x0000000000A43000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing