xloader | 81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596

General

Target

81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe
Size

289KB
MD5

51c46cfdcb94cf241595e99600ba40b3
SHA1

00ca9779115daee4f009d1048994270e5d9f86ab
SHA256

81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596
SHA512

75cc385fd4b22d55cd5b89b417b81abe98689e6cad7977ca8eb2348a74eb54f60f53868f3e4d08ac47dfc79553ee78e41bc0c6f51d98a87b14ad78bd00b6cb63

Score

10^/10

xloader m0np loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

m0np

C2

http://www.devmedicalcentre.com/m0np/

Decoy

gruppovimar.com

seniordatingtv.com

pinpinyouqian.website

retreatreflectreplenish.com

baby-handmade.store

econsupplies.com

helloaustinpodcast.com

europe-lodging.com

ferahanaokulu.com

thehomeinspo.com

rawhoneytnpasumo6.xyz

tyckasei.quest

scissorsandbuffer.com

jatinvestmentsmaldives.com

softandcute.store

afuturemakerspromotions.online

leonsigntech.com

havetheshortscovered.com

cvkf.email

iplyyu.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3668-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/3668-117-0x000000000041D450-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe

pid process

3320 81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe

pid	process
3320	81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe

description	pid	process	target process
PID 3320 set thread context of 3668	3320	81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe	81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe

pid	process
3668	81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe
3668	81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe

description	pid	process	target process
PID 3320 wrote to memory of 3668	3320	81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe	81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe
PID 3320 wrote to memory of 3668	3320	81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe	81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe
PID 3320 wrote to memory of 3668	3320	81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe	81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe
PID 3320 wrote to memory of 3668	3320	81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe	81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe
PID 3320 wrote to memory of 3668	3320	81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe	81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe
PID 3320 wrote to memory of 3668	3320	81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe	81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe

C:\Users\Admin\AppData\Local\Temp\81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe
"C:\Users\Admin\AppData\Local\Temp\81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3320

C:\Users\Admin\AppData\Local\Temp\81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe
"C:\Users\Admin\AppData\Local\Temp\81b5af95b241a5a77293e9a905ea32c69da468f568f798ec5ea535071e930596.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3668

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsp8600.tmp\xbinoq.dll
MD5
0b920b2f27590b67c54f3787103f2180

SHA1
029a495fbb09ea3dca28807fd815baf8b541206f

SHA256
a9f72389f209e74e5e0ccc368a81866e59f873869e17e9e03572e3419f20d14f

SHA512
8833913d5cafba7b025096cb573aeebf64f62e13ecccabd6d07e076293abba3c103d6abd4cc607086184fe45516dc26b117d871ab33b1b6f210f7b76079c4b4b

Download Submit
memory/3668-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3668-117-0x000000000041D450-mapping.dmp

Download
memory/3668-118-0x0000000000A00000-0x0000000000D20000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads