xloader | 0d42799a7602de1d76ef3b39ceff5075b95dd1e3891332987d525a07ef5c5f0f

General

Target

c351e71c1b6e1cefb2ee8e8695c83efb.exe
Size

480KB
MD5

c351e71c1b6e1cefb2ee8e8695c83efb
SHA1

3d10b631ccb836b33975d2a4a9ea23c1f6ff8449
SHA256

0d42799a7602de1d76ef3b39ceff5075b95dd1e3891332987d525a07ef5c5f0f
SHA512

b3e9ab3c3beaddd4cb2b0270049512b78ddf4920fd96bb25865faf33ce4f1e01dc736a7e9ee6b6981634e21c8a1681cd8275df3970be319280f72f444ae01acd

Score

10^/10

xloader pnug loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1884-56-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

c351e71c1b6e1cefb2ee8e8695c83efb.exe

pid process

960 c351e71c1b6e1cefb2ee8e8695c83efb.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

c351e71c1b6e1cefb2ee8e8695c83efb.exe

description pid process target process

PID 960 set thread context of 1884 960 c351e71c1b6e1cefb2ee8e8695c83efb.exe c351e71c1b6e1cefb2ee8e8695c83efb.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c351e71c1b6e1cefb2ee8e8695c83efb.exe

pid process

1884 c351e71c1b6e1cefb2ee8e8695c83efb.exe

pid	process
960	c351e71c1b6e1cefb2ee8e8695c83efb.exe

description	pid	process	target process
PID 960 set thread context of 1884	960	c351e71c1b6e1cefb2ee8e8695c83efb.exe	c351e71c1b6e1cefb2ee8e8695c83efb.exe

pid	process
1884	c351e71c1b6e1cefb2ee8e8695c83efb.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

c351e71c1b6e1cefb2ee8e8695c83efb.exe

description	pid	process	target process
PID 960 wrote to memory of 1884	960	c351e71c1b6e1cefb2ee8e8695c83efb.exe	c351e71c1b6e1cefb2ee8e8695c83efb.exe
PID 960 wrote to memory of 1884	960	c351e71c1b6e1cefb2ee8e8695c83efb.exe	c351e71c1b6e1cefb2ee8e8695c83efb.exe
PID 960 wrote to memory of 1884	960	c351e71c1b6e1cefb2ee8e8695c83efb.exe	c351e71c1b6e1cefb2ee8e8695c83efb.exe
PID 960 wrote to memory of 1884	960	c351e71c1b6e1cefb2ee8e8695c83efb.exe	c351e71c1b6e1cefb2ee8e8695c83efb.exe
PID 960 wrote to memory of 1884	960	c351e71c1b6e1cefb2ee8e8695c83efb.exe	c351e71c1b6e1cefb2ee8e8695c83efb.exe
PID 960 wrote to memory of 1884	960	c351e71c1b6e1cefb2ee8e8695c83efb.exe	c351e71c1b6e1cefb2ee8e8695c83efb.exe
PID 960 wrote to memory of 1884	960	c351e71c1b6e1cefb2ee8e8695c83efb.exe	c351e71c1b6e1cefb2ee8e8695c83efb.exe

C:\Users\Admin\AppData\Local\Temp\c351e71c1b6e1cefb2ee8e8695c83efb.exe
"C:\Users\Admin\AppData\Local\Temp\c351e71c1b6e1cefb2ee8e8695c83efb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:960

C:\Users\Admin\AppData\Local\Temp\c351e71c1b6e1cefb2ee8e8695c83efb.exe
"C:\Users\Admin\AppData\Local\Temp\c351e71c1b6e1cefb2ee8e8695c83efb.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1884

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsnC341.tmp\aptadt.dll
MD5
5cf1ec7c33dcb8d0ad47c4729f6a17d5

SHA1
d3af7acc440f312830b5b36b4cb3925c7aa0ff75

SHA256
c6223791ed7ca60bca47b53e961aaaf7d5c8354b3df3e6c64df6fc3518f2c529

SHA512
dbbb343f06eb1f28b9baccbcd275036c6c4690b3af128587dbbf07882aa575f6df2f28513cfc465fce176b20d006fd76b0ca5b1bd53803a2a29898b587fe38b4

Download Submit
memory/960-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1884-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1884-57-0x0000000000740000-0x0000000000A43000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing