xloader | 15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f

General

Target

15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe
Size

905KB
MD5

548d5acd91befcf89ccc80c9d8256002
SHA1

776f4950f8109003c1d88e53d7921d27280a3ae7
SHA256

15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f
SHA512

66d54b8c882ffd9c47e941fcaa35e95c0b1f31281b7490b444b7bc65ead3377d2d4d7f82b53201dedd03771ac38f498760898005b9a5287b4e9997a152ab01a6

Score

10^/10

xloader pnug loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3472-125-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/3472-126-0x000000000041D400-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe

description	pid	process	target process
PID 2680 set thread context of 3472	2680	15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe	15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe

pid	process
3472	15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe
3472	15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe

description	pid	process	target process
PID 2680 wrote to memory of 3472	2680	15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe	15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe
PID 2680 wrote to memory of 3472	2680	15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe	15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe
PID 2680 wrote to memory of 3472	2680	15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe	15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe
PID 2680 wrote to memory of 3472	2680	15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe	15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe
PID 2680 wrote to memory of 3472	2680	15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe	15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe
PID 2680 wrote to memory of 3472	2680	15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe	15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe

C:\Users\Admin\AppData\Local\Temp\15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe
"C:\Users\Admin\AppData\Local\Temp\15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2680

C:\Users\Admin\AppData\Local\Temp\15f9ae45222e5eb82ac39303b8f9b852399bbf3ea54c3f7ff7d04e76756bc43f.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-115-0x00000000003D0000-0x00000000004B8000-memory.dmp

Filesize
928KB

Download
memory/2680-116-0x00000000003D0000-0x00000000004B8000-memory.dmp

Filesize
928KB

Download
memory/2680-117-0x0000000005120000-0x000000000561E000-memory.dmp

Filesize
5.0MB

Download
memory/2680-118-0x0000000004D00000-0x0000000004D92000-memory.dmp

Filesize
584KB

Download
memory/2680-119-0x0000000004E40000-0x0000000004EDC000-memory.dmp

Filesize
624KB

Download
memory/2680-120-0x0000000004CE0000-0x0000000004CEA000-memory.dmp

Filesize
40KB

Download
memory/2680-121-0x0000000004C20000-0x000000000511E000-memory.dmp

Filesize
5.0MB

Download
memory/2680-122-0x0000000005070000-0x000000000507A000-memory.dmp

Filesize
40KB

Download
memory/2680-123-0x0000000008BC0000-0x0000000008C3E000-memory.dmp

Filesize
504KB

Download
memory/2680-124-0x00000000050F0000-0x0000000005120000-memory.dmp

Filesize
192KB

Download
memory/3472-125-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3472-126-0x000000000041D400-mapping.dmp

Download
memory/3472-127-0x0000000001330000-0x0000000001650000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads