xloader | c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678

General

Target

c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe
Size

520KB
MD5

ec3c4e67052153971525c0691671fb1b
SHA1

76fd777f80ae4905dccac5c3056b9779c927d1cc
SHA256

c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678
SHA512

77dbff6d28b904c2096094206f721c22fa9d2474e55a55bf7e5f734d644738a624c6cbb9f6a9ca1da58b8ff9b808af85b259dd9f889fc5047dac097cd4f0b8ef

Score

10^/10

xloader pnug loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3124-115-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/3124-116-0x000000000041D400-mapping.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe

pid process

3052 c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe

pid	process
3052	c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe

description	pid	process	target process
PID 3052 set thread context of 3124	3052	c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe	c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe

pid	process
3124	c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe
3124	c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe

description	pid	process	target process
PID 3052 wrote to memory of 3124	3052	c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe	c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe
PID 3052 wrote to memory of 3124	3052	c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe	c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe
PID 3052 wrote to memory of 3124	3052	c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe	c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe
PID 3052 wrote to memory of 3124	3052	c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe	c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe
PID 3052 wrote to memory of 3124	3052	c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe	c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe
PID 3052 wrote to memory of 3124	3052	c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe	c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe

C:\Users\Admin\AppData\Local\Temp\c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe
"C:\Users\Admin\AppData\Local\Temp\c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3052

C:\Users\Admin\AppData\Local\Temp\c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe
"C:\Users\Admin\AppData\Local\Temp\c5f98ce0715f0bd5d20c6a9c94502b01877f83859aebe53f62bc3d278eb05678.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3124

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nshA2BB.tmp\hmoxcy.dll
MD5
afae911d06f47aa201577f054c6faeb3

SHA1
e303a0bd43874aa21d81b517e7c814e422c7b0cc

SHA256
b48a2ce2169e18b72b9b618b483148d68bb75c720d8f45b468dfd6969b76d33b

SHA512
8aee62fb4b274217cdbd0e8b216e01b0209fd1e97173614697d5d470920c7db41c87241e72f55e231156be91d95871bd43a2dd73bb285814de96cb7a273e1342

Download Submit
memory/3124-115-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3124-116-0x000000000041D400-mapping.dmp

Download
memory/3124-117-0x0000000000B00000-0x0000000000E20000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads