xloader | a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3

General

Target

ee0a3d31b64011310ae0a4fde697aa25.exe
Size

441KB
MD5

ee0a3d31b64011310ae0a4fde697aa25
SHA1

5d9fd5352b9e0f268cd495d2061e31c9fada2c53
SHA256

a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3
SHA512

2ee81b14384fded53344ce3501d30188b65d7ffa94ca54cb57ff5c291db9dc8334760ebc4735da3a0ecae3fa89bc40841064918aac738eee5b1b9943426ac8f4

Score

10^/10

xloader pnug loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/952-57-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

ee0a3d31b64011310ae0a4fde697aa25.exe

pid process

304 ee0a3d31b64011310ae0a4fde697aa25.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

ee0a3d31b64011310ae0a4fde697aa25.exe

description pid process target process

PID 304 set thread context of 952 304 ee0a3d31b64011310ae0a4fde697aa25.exe ee0a3d31b64011310ae0a4fde697aa25.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ee0a3d31b64011310ae0a4fde697aa25.exe

pid process

952 ee0a3d31b64011310ae0a4fde697aa25.exe

pid	process
304	ee0a3d31b64011310ae0a4fde697aa25.exe

description	pid	process	target process
PID 304 set thread context of 952	304	ee0a3d31b64011310ae0a4fde697aa25.exe	ee0a3d31b64011310ae0a4fde697aa25.exe

pid	process
952	ee0a3d31b64011310ae0a4fde697aa25.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

ee0a3d31b64011310ae0a4fde697aa25.exe

description	pid	process	target process
PID 304 wrote to memory of 952	304	ee0a3d31b64011310ae0a4fde697aa25.exe	ee0a3d31b64011310ae0a4fde697aa25.exe
PID 304 wrote to memory of 952	304	ee0a3d31b64011310ae0a4fde697aa25.exe	ee0a3d31b64011310ae0a4fde697aa25.exe
PID 304 wrote to memory of 952	304	ee0a3d31b64011310ae0a4fde697aa25.exe	ee0a3d31b64011310ae0a4fde697aa25.exe
PID 304 wrote to memory of 952	304	ee0a3d31b64011310ae0a4fde697aa25.exe	ee0a3d31b64011310ae0a4fde697aa25.exe
PID 304 wrote to memory of 952	304	ee0a3d31b64011310ae0a4fde697aa25.exe	ee0a3d31b64011310ae0a4fde697aa25.exe
PID 304 wrote to memory of 952	304	ee0a3d31b64011310ae0a4fde697aa25.exe	ee0a3d31b64011310ae0a4fde697aa25.exe
PID 304 wrote to memory of 952	304	ee0a3d31b64011310ae0a4fde697aa25.exe	ee0a3d31b64011310ae0a4fde697aa25.exe

C:\Users\Admin\AppData\Local\Temp\ee0a3d31b64011310ae0a4fde697aa25.exe
"C:\Users\Admin\AppData\Local\Temp\ee0a3d31b64011310ae0a4fde697aa25.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:304

C:\Users\Admin\AppData\Local\Temp\ee0a3d31b64011310ae0a4fde697aa25.exe
"C:\Users\Admin\AppData\Local\Temp\ee0a3d31b64011310ae0a4fde697aa25.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:952

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsoECB2.tmp\ltnehpemyq.dll
MD5
4438b2bb74143e0dc75d88ff3cf9c3c6

SHA1
9bf6b14d33509bfbf10d967812857728595a5d8e

SHA256
5b870a41f4559e86d3f3d0cec40364a6bd8aa606d044ade4f7d488f714523751

SHA512
fed4113ec2d28c9f9aa8c04524fa1f4d803189edcecda9743ae8550fa28e6ff92d1247466e2bf420622812cf238e8be4cf61eb5f9768f578c7de5a0101c285ef

Download Submit
memory/304-55-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download
memory/952-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/952-58-0x0000000000850000-0x0000000000B53000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing