xloader | 19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5

General

Target

19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe
Size

254KB
MD5

73fe142254abec3aeaef375f0564d40a
SHA1

8529d972dd89f69eb2dc2a3ba9207e67626de9b9
SHA256

19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5
SHA512

848d4bc144f1f861823f08ab355184786f3832555236dffa2b5639e3ceb6c2578ff0da8c3870ba26f11f7609f0f4bbc50312db565c3a6adc6e8e3155915b328e

Score

10^/10

xloader kqna loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

kqna

C2

http://www.surfsolutions.info/kqna/

Decoy

achyutlifesciences.com

anthemmg.com

netkopat.com

generationgirlnaturals.com

novatel-network.com

craftstockco.com

thevishantiverse.art

elkerfly.com

haerotechs.com

candypalette.com

gregdokes.com

e-commerce.company

gratitudeland.com

companyintelcloud.com

publicyazilim.com

xc6811.com

aracsozluk.com

janesgalant.quest

fraserstephendop.com

ryan.rentals

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1084-119-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1084-120-0x000000000041D400-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe

pid process

660 19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe

pid	process
660	19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe

description	pid	process	target process
PID 660 set thread context of 1084	660	19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe	19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe

pid	process
1084	19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe
1084	19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe

description	pid	process	target process
PID 660 wrote to memory of 1084	660	19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe	19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe
PID 660 wrote to memory of 1084	660	19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe	19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe
PID 660 wrote to memory of 1084	660	19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe	19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe
PID 660 wrote to memory of 1084	660	19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe	19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe
PID 660 wrote to memory of 1084	660	19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe	19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe
PID 660 wrote to memory of 1084	660	19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe	19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe

C:\Users\Admin\AppData\Local\Temp\19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe
"C:\Users\Admin\AppData\Local\Temp\19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:660

C:\Users\Admin\AppData\Local\Temp\19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe
"C:\Users\Admin\AppData\Local\Temp\19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1084

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsn318C.tmp\yhjjbtf.dll
MD5
2109a0431e1e8fbce8007bc6dbdc8d2d

SHA1
f85d1cfa01ca893063af01510115bc279da84c2a

SHA256
520857c7a5bfaeebf0f39504ae85d32b7e153774e93cb2be486f9a5d35b76d05

SHA512
a190901c467b65b18370aa3dbec9bb994294042fb78965b6baaf92a31fdc316912679a23f81f76a0d30f51c9c9ccbabcd58b0d420a1c6060508de1f0c0d320fb

Download Submit
memory/1084-119-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1084-120-0x000000000041D400-mapping.dmp

Download
memory/1084-121-0x00000000009E0000-0x0000000000D00000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads