xloader | 5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9

General

Target

5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe
Size

552KB
MD5

175f006164182d3a95bf61ea207b7944
SHA1

e6586c82b4f92784edbf7640a63c0425dc51705b
SHA256

5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9
SHA512

6266b69aae421079890fb7f189a0c913af5a42a2fdf91b6189fa6e394f4272d00a5114aa7888012d14049e78db70f48fd1f51d883a9cbbedfcdbe3ea217576c0

Score

10^/10

xloader pnug loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2888-116-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2888-117-0x000000000041D400-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe

pid process

2496 5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe

pid	process
2496	5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe

description	pid	process	target process
PID 2496 set thread context of 2888	2496	5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe	5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe

pid	process
2888	5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe
2888	5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe

description	pid	process	target process
PID 2496 wrote to memory of 2888	2496	5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe	5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe
PID 2496 wrote to memory of 2888	2496	5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe	5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe
PID 2496 wrote to memory of 2888	2496	5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe	5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe
PID 2496 wrote to memory of 2888	2496	5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe	5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe
PID 2496 wrote to memory of 2888	2496	5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe	5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe
PID 2496 wrote to memory of 2888	2496	5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe	5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe

C:\Users\Admin\AppData\Local\Temp\5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe
"C:\Users\Admin\AppData\Local\Temp\5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2496

C:\Users\Admin\AppData\Local\Temp\5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe
"C:\Users\Admin\AppData\Local\Temp\5f9bc09e4b5b782ff1b0cb564bd217b31c79e0ca253c136b7f5e4744460b2bb9.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2888

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsuC229.tmp\ecmyip.dll
MD5
587e0148246f200131e685053a52c0a5

SHA1
e6a0568b40d9ec45b85d5104ab48a0e3ca211a48

SHA256
81b25e92a746fdefe306e54c486f4ee3b070250e1f0c0f8baf5570054a04fc17

SHA512
99d4803fa9005707e81ae1b2aeb6c585783459a6d1635907c35fcf52cc8083c9154f25a6af2f0b105350090d580430d04bcefbaca191db2d9c053c823b7d2393

Download Submit
memory/2888-116-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2888-117-0x000000000041D400-mapping.dmp

Download
memory/2888-118-0x0000000000A70000-0x0000000000D90000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads