xloader | cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6

General

Target

e652e263f71c1c50220920a46c9b420e.exe
Size

555KB
MD5

e652e263f71c1c50220920a46c9b420e
SHA1

08379f562329d48fe67b0f4e7ee4ad37a0b97924
SHA256

cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6
SHA512

8a622158d7d2114b4ff80e73058755582d6b641b347f867499a1c2163d9e9dbab5071fd44d975cda74ac4b35542f2bc9fdc8cb68551296c75251e395ce3f8309

Score

10^/10

xloader pnug loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/672-56-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

e652e263f71c1c50220920a46c9b420e.exe

pid process

1624 e652e263f71c1c50220920a46c9b420e.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

e652e263f71c1c50220920a46c9b420e.exe

description pid process target process

PID 1624 set thread context of 672 1624 e652e263f71c1c50220920a46c9b420e.exe e652e263f71c1c50220920a46c9b420e.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e652e263f71c1c50220920a46c9b420e.exe

pid process

672 e652e263f71c1c50220920a46c9b420e.exe

pid	process
1624	e652e263f71c1c50220920a46c9b420e.exe

description	pid	process	target process
PID 1624 set thread context of 672	1624	e652e263f71c1c50220920a46c9b420e.exe	e652e263f71c1c50220920a46c9b420e.exe

pid	process
672	e652e263f71c1c50220920a46c9b420e.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

e652e263f71c1c50220920a46c9b420e.exe

description	pid	process	target process
PID 1624 wrote to memory of 672	1624	e652e263f71c1c50220920a46c9b420e.exe	e652e263f71c1c50220920a46c9b420e.exe
PID 1624 wrote to memory of 672	1624	e652e263f71c1c50220920a46c9b420e.exe	e652e263f71c1c50220920a46c9b420e.exe
PID 1624 wrote to memory of 672	1624	e652e263f71c1c50220920a46c9b420e.exe	e652e263f71c1c50220920a46c9b420e.exe
PID 1624 wrote to memory of 672	1624	e652e263f71c1c50220920a46c9b420e.exe	e652e263f71c1c50220920a46c9b420e.exe
PID 1624 wrote to memory of 672	1624	e652e263f71c1c50220920a46c9b420e.exe	e652e263f71c1c50220920a46c9b420e.exe
PID 1624 wrote to memory of 672	1624	e652e263f71c1c50220920a46c9b420e.exe	e652e263f71c1c50220920a46c9b420e.exe
PID 1624 wrote to memory of 672	1624	e652e263f71c1c50220920a46c9b420e.exe	e652e263f71c1c50220920a46c9b420e.exe

C:\Users\Admin\AppData\Local\Temp\e652e263f71c1c50220920a46c9b420e.exe
"C:\Users\Admin\AppData\Local\Temp\e652e263f71c1c50220920a46c9b420e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1624

C:\Users\Admin\AppData\Local\Temp\e652e263f71c1c50220920a46c9b420e.exe
"C:\Users\Admin\AppData\Local\Temp\e652e263f71c1c50220920a46c9b420e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:672

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsyEEC4.tmp\lsjtl.dll
MD5
aeba88fedc5242964243789b0452de7c

SHA1
5467c97a667d0751eb59b59408ff74ff649cb42e

SHA256
6a0a8136977732a180d9e9b85a82567167d2a0443461305b53211ea511bb48fe

SHA512
8e09421857a14f5ccf73e57a8d6cd79b85d89eade295a1bf82fa819834f03fcaa2c729a047b0f27dcc1cae743d6687b7c3080fc6f531f55fbc81928568c924d7

Download Submit
memory/672-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/672-57-0x0000000000830000-0x0000000000B33000-memory.dmp

Filesize
3.0MB

Download
memory/1624-54-0x0000000076C61000-0x0000000076C63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing