xloader | 2ffbb436257f6f348fade42e94df5737ab8b9d9848a220206992c52d917a7b5e

General

Target

0031a23b4bb6abcdccc5f8122de5fcb5.exe
Size

283KB
MD5

0031a23b4bb6abcdccc5f8122de5fcb5
SHA1

be50cdbb0af4c77229e3de0ec7f34088aae64dc2
SHA256

2ffbb436257f6f348fade42e94df5737ab8b9d9848a220206992c52d917a7b5e
SHA512

eed60bda2d0a5fb02f823db8caf57d136dc6d003f49ca7d3cb6a620dcb1cf4ad4e52c6b9a40aefe9126f9e137776ae23d78a2648f5609fa3d69989ab3d185cc2

Score

10^/10

xloader mxnu loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mxnu

C2

http://www.naplesconciergerealty.com/mxnu/

Decoy

insightmyhome.com

gabriellamaxey.com

029atk.xyz

marshconstructions.com

technichoffghosts.com

blue-ivy-boutique-au.com

1sunsetgroup.com

elfkuhnispb.store

caoliudh.club

verifiedpaypal.net

jellyice-tr.com

gatescres.com

bloomberq.online

crystaltopagent.net

uggs-line.com

ecommerceplatform.xyz

historyofcambridge.com

sattaking-gaziabad.xyz

digisor.com

beachpawsmobilegrooming.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2788-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/2788-117-0x000000000041D4A0-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

0031a23b4bb6abcdccc5f8122de5fcb5.exe

pid process

2412 0031a23b4bb6abcdccc5f8122de5fcb5.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

0031a23b4bb6abcdccc5f8122de5fcb5.exe

description pid process target process

PID 2412 set thread context of 2788 2412 0031a23b4bb6abcdccc5f8122de5fcb5.exe 0031a23b4bb6abcdccc5f8122de5fcb5.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

0031a23b4bb6abcdccc5f8122de5fcb5.exe

pid process

2788 0031a23b4bb6abcdccc5f8122de5fcb5.exe
2788 0031a23b4bb6abcdccc5f8122de5fcb5.exe

pid	process
2412	0031a23b4bb6abcdccc5f8122de5fcb5.exe

description	pid	process	target process
PID 2412 set thread context of 2788	2412	0031a23b4bb6abcdccc5f8122de5fcb5.exe	0031a23b4bb6abcdccc5f8122de5fcb5.exe

pid	process
2788	0031a23b4bb6abcdccc5f8122de5fcb5.exe
2788	0031a23b4bb6abcdccc5f8122de5fcb5.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

0031a23b4bb6abcdccc5f8122de5fcb5.exe

description	pid	process	target process
PID 2412 wrote to memory of 2788	2412	0031a23b4bb6abcdccc5f8122de5fcb5.exe	0031a23b4bb6abcdccc5f8122de5fcb5.exe
PID 2412 wrote to memory of 2788	2412	0031a23b4bb6abcdccc5f8122de5fcb5.exe	0031a23b4bb6abcdccc5f8122de5fcb5.exe
PID 2412 wrote to memory of 2788	2412	0031a23b4bb6abcdccc5f8122de5fcb5.exe	0031a23b4bb6abcdccc5f8122de5fcb5.exe
PID 2412 wrote to memory of 2788	2412	0031a23b4bb6abcdccc5f8122de5fcb5.exe	0031a23b4bb6abcdccc5f8122de5fcb5.exe
PID 2412 wrote to memory of 2788	2412	0031a23b4bb6abcdccc5f8122de5fcb5.exe	0031a23b4bb6abcdccc5f8122de5fcb5.exe
PID 2412 wrote to memory of 2788	2412	0031a23b4bb6abcdccc5f8122de5fcb5.exe	0031a23b4bb6abcdccc5f8122de5fcb5.exe

C:\Users\Admin\AppData\Local\Temp\0031a23b4bb6abcdccc5f8122de5fcb5.exe
"C:\Users\Admin\AppData\Local\Temp\0031a23b4bb6abcdccc5f8122de5fcb5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2412

C:\Users\Admin\AppData\Local\Temp\0031a23b4bb6abcdccc5f8122de5fcb5.exe
"C:\Users\Admin\AppData\Local\Temp\0031a23b4bb6abcdccc5f8122de5fcb5.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2788

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsb9FEB.tmp\dulsmde.dll
MD5
9dcfa8231f1896ca0d48d53fb116841d

SHA1
13f92a4af7931b2aabd918d6d3cf4589e316331b

SHA256
6e1d37a9909f1774db945f4427800e4d0b821fdca41598f12dba41b59fa3c901

SHA512
75d3a9ff265971c659444bd13fc28f90a77e0ce709a34a6c46f9ec75fd7f337df5dbf5ec74b4129890b4b724e40aa10863f6d8d7e74a747ce7c5311f97513d09

Download Submit
memory/2788-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2788-117-0x000000000041D4A0-mapping.dmp

Download
memory/2788-118-0x0000000000A10000-0x0000000000D30000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing