xloader | dc79715b1603acf022ff683ea5042eda16428d8d383d3779b292e8ea8c72f81a

General

Target

cd082d86c8243824b21969ef80ebd2e8.exe
Size

248KB
MD5

cd082d86c8243824b21969ef80ebd2e8
SHA1

dae3abb03aaab4bed3733d8756b8ddca512c9806
SHA256

dc79715b1603acf022ff683ea5042eda16428d8d383d3779b292e8ea8c72f81a
SHA512

73218fbaf8b7ee9c6d729f30e88fcf7c491dd6af09bd06af5dd4ef956cc0243e2d4a2c7f04ea9e67f7a6242bdcc2fec174c8d3693e6a629ad04bcbbe86f0a5bf

Score

10^/10

xloader mxnu loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mxnu

C2

http://www.naplesconciergerealty.com/mxnu/

Decoy

insightmyhome.com

gabriellamaxey.com

029atk.xyz

marshconstructions.com

technichoffghosts.com

blue-ivy-boutique-au.com

1sunsetgroup.com

elfkuhnispb.store

caoliudh.club

verifiedpaypal.net

jellyice-tr.com

gatescres.com

bloomberq.online

crystaltopagent.net

uggs-line.com

ecommerceplatform.xyz

historyofcambridge.com

sattaking-gaziabad.xyz

digisor.com

beachpawsmobilegrooming.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3788-115-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/3788-116-0x000000000041D4A0-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

cd082d86c8243824b21969ef80ebd2e8.exe

pid process

3728 cd082d86c8243824b21969ef80ebd2e8.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

cd082d86c8243824b21969ef80ebd2e8.exe

description pid process target process

PID 3728 set thread context of 3788 3728 cd082d86c8243824b21969ef80ebd2e8.exe cd082d86c8243824b21969ef80ebd2e8.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

cd082d86c8243824b21969ef80ebd2e8.exe

pid process

3788 cd082d86c8243824b21969ef80ebd2e8.exe
3788 cd082d86c8243824b21969ef80ebd2e8.exe

pid	process
3728	cd082d86c8243824b21969ef80ebd2e8.exe

description	pid	process	target process
PID 3728 set thread context of 3788	3728	cd082d86c8243824b21969ef80ebd2e8.exe	cd082d86c8243824b21969ef80ebd2e8.exe

pid	process
3788	cd082d86c8243824b21969ef80ebd2e8.exe
3788	cd082d86c8243824b21969ef80ebd2e8.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cd082d86c8243824b21969ef80ebd2e8.exe

description	pid	process	target process
PID 3728 wrote to memory of 3788	3728	cd082d86c8243824b21969ef80ebd2e8.exe	cd082d86c8243824b21969ef80ebd2e8.exe
PID 3728 wrote to memory of 3788	3728	cd082d86c8243824b21969ef80ebd2e8.exe	cd082d86c8243824b21969ef80ebd2e8.exe
PID 3728 wrote to memory of 3788	3728	cd082d86c8243824b21969ef80ebd2e8.exe	cd082d86c8243824b21969ef80ebd2e8.exe
PID 3728 wrote to memory of 3788	3728	cd082d86c8243824b21969ef80ebd2e8.exe	cd082d86c8243824b21969ef80ebd2e8.exe
PID 3728 wrote to memory of 3788	3728	cd082d86c8243824b21969ef80ebd2e8.exe	cd082d86c8243824b21969ef80ebd2e8.exe
PID 3728 wrote to memory of 3788	3728	cd082d86c8243824b21969ef80ebd2e8.exe	cd082d86c8243824b21969ef80ebd2e8.exe

C:\Users\Admin\AppData\Local\Temp\cd082d86c8243824b21969ef80ebd2e8.exe
"C:\Users\Admin\AppData\Local\Temp\cd082d86c8243824b21969ef80ebd2e8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3728

C:\Users\Admin\AppData\Local\Temp\cd082d86c8243824b21969ef80ebd2e8.exe
"C:\Users\Admin\AppData\Local\Temp\cd082d86c8243824b21969ef80ebd2e8.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3788

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nss66CF.tmp\qjlai.dll
MD5
6c8b646db465cc86802da2d0998b6f41

SHA1
14718c272ce06b56bd65fc60d17ab19be45f8766

SHA256
ffe13c127deadbd715b04324469a50e3f88f4f2aa1497350052a579ec41cdeeb

SHA512
b957b26f07f31fdc9da2f72f87b4af03f94a8f1b2618d5c1fe1e69ddb571f1cda7412ced4e54e7c328f0695b758bffea5a9a6719ea104872a158d265b1185549

Download Submit
memory/3788-115-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3788-116-0x000000000041D4A0-mapping.dmp

Download
memory/3788-117-0x0000000000950000-0x0000000000C70000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing