xloader | f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032

General

Target

f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe
Size

253KB
MD5

d0e4c13e6c8ba9fe34d86b554b595d9a
SHA1

83eee2dbe00ae265af9eb13105dc1068b6b034cd
SHA256

f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032
SHA512

72f5fcd367c0f0fdc83827bea529f84a85ace28550a5cd8102cb0cde2829d81defe312fb0d95d3c5a8e8728f4efd8cb433bfab0b3e1f265fffdc4e0ad687247d

Score

10^/10

xloader kqna loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

kqna

C2

http://www.surfsolutions.info/kqna/

Decoy

achyutlifesciences.com

anthemmg.com

netkopat.com

generationgirlnaturals.com

novatel-network.com

craftstockco.com

thevishantiverse.art

elkerfly.com

haerotechs.com

candypalette.com

gregdokes.com

e-commerce.company

gratitudeland.com

companyintelcloud.com

publicyazilim.com

xc6811.com

aracsozluk.com

janesgalant.quest

fraserstephendop.com

ryan.rentals

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2820-119-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2820-120-0x000000000041D400-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe

pid process

648 f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe

pid	process
648	f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe

description	pid	process	target process
PID 648 set thread context of 2820	648	f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe	f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe

pid	process
2820	f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe
2820	f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe

description	pid	process	target process
PID 648 wrote to memory of 2820	648	f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe	f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe
PID 648 wrote to memory of 2820	648	f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe	f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe
PID 648 wrote to memory of 2820	648	f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe	f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe
PID 648 wrote to memory of 2820	648	f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe	f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe
PID 648 wrote to memory of 2820	648	f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe	f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe
PID 648 wrote to memory of 2820	648	f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe	f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe

C:\Users\Admin\AppData\Local\Temp\f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe
"C:\Users\Admin\AppData\Local\Temp\f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648

C:\Users\Admin\AppData\Local\Temp\f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe
"C:\Users\Admin\AppData\Local\Temp\f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsu276B.tmp\oirygpbyia.dll
MD5
6d2a0ca8aac6594e4f037d3cecdace3b

SHA1
2fdc815752d2483ae536ed60dd2104b0e5cc2abd

SHA256
f7a3aa43e037f6b25c8070b3aaac9f0c5037abb1c4d01afd30a6f52f7c44f468

SHA512
cacc25100aedd926141416ef443dd40f03cb6b1512129bd707fc8ece1c9db2ad9a1de559e8cb3d29b569e2b1b843822f4ef681c4ea33bc5a6a290a3f17bdb7ee

Download Submit
memory/2820-119-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2820-120-0x000000000041D400-mapping.dmp

Download
memory/2820-121-0x00000000009A0000-0x0000000000CC0000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads