xloader | 41e0f6ad541e5253c451b3d51976df257813e85c443ab1b863b3acf6c078b38c

General

Target

f328a43f0ed25b23d8e5eddcd3d4e96a.exe
Size

463KB
MD5

f328a43f0ed25b23d8e5eddcd3d4e96a
SHA1

f2774f50aabd73d03ac45447fa1aac4563348af9
SHA256

41e0f6ad541e5253c451b3d51976df257813e85c443ab1b863b3acf6c078b38c
SHA512

a31b377c5e92616a1d0f14b613402813ae92565a999a6a9e8fa63d39a5535651357f96772928b3869e6322a861bd281e37b6dafe3b1f8aa29e8be40728c44b26

Score

10^/10

xloader pnug loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/528-119-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

f328a43f0ed25b23d8e5eddcd3d4e96a.exe

pid process

2556 f328a43f0ed25b23d8e5eddcd3d4e96a.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

f328a43f0ed25b23d8e5eddcd3d4e96a.exe

description pid process target process

PID 2556 set thread context of 528 2556 f328a43f0ed25b23d8e5eddcd3d4e96a.exe f328a43f0ed25b23d8e5eddcd3d4e96a.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f328a43f0ed25b23d8e5eddcd3d4e96a.exe

pid process

528 f328a43f0ed25b23d8e5eddcd3d4e96a.exe
528 f328a43f0ed25b23d8e5eddcd3d4e96a.exe

pid	process
2556	f328a43f0ed25b23d8e5eddcd3d4e96a.exe

description	pid	process	target process
PID 2556 set thread context of 528	2556	f328a43f0ed25b23d8e5eddcd3d4e96a.exe	f328a43f0ed25b23d8e5eddcd3d4e96a.exe

pid	process
528	f328a43f0ed25b23d8e5eddcd3d4e96a.exe
528	f328a43f0ed25b23d8e5eddcd3d4e96a.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f328a43f0ed25b23d8e5eddcd3d4e96a.exe

description	pid	process	target process
PID 2556 wrote to memory of 528	2556	f328a43f0ed25b23d8e5eddcd3d4e96a.exe	f328a43f0ed25b23d8e5eddcd3d4e96a.exe
PID 2556 wrote to memory of 528	2556	f328a43f0ed25b23d8e5eddcd3d4e96a.exe	f328a43f0ed25b23d8e5eddcd3d4e96a.exe
PID 2556 wrote to memory of 528	2556	f328a43f0ed25b23d8e5eddcd3d4e96a.exe	f328a43f0ed25b23d8e5eddcd3d4e96a.exe
PID 2556 wrote to memory of 528	2556	f328a43f0ed25b23d8e5eddcd3d4e96a.exe	f328a43f0ed25b23d8e5eddcd3d4e96a.exe
PID 2556 wrote to memory of 528	2556	f328a43f0ed25b23d8e5eddcd3d4e96a.exe	f328a43f0ed25b23d8e5eddcd3d4e96a.exe
PID 2556 wrote to memory of 528	2556	f328a43f0ed25b23d8e5eddcd3d4e96a.exe	f328a43f0ed25b23d8e5eddcd3d4e96a.exe

C:\Users\Admin\AppData\Local\Temp\f328a43f0ed25b23d8e5eddcd3d4e96a.exe
"C:\Users\Admin\AppData\Local\Temp\f328a43f0ed25b23d8e5eddcd3d4e96a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2556

C:\Users\Admin\AppData\Local\Temp\f328a43f0ed25b23d8e5eddcd3d4e96a.exe
"C:\Users\Admin\AppData\Local\Temp\f328a43f0ed25b23d8e5eddcd3d4e96a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:528

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsnBA6.tmp\koxsnjp.dll
MD5
df346e3a880b6e1cad15024844bc140b

SHA1
4fa69b1a80af84d85d0709b50a11924a954c904d

SHA256
c744a4435d81489ef625898e53053f42e20ed3636aa379608b9f5f3553183e05

SHA512
8965e7d7200682df8a93b8d90be17b8ce455af510a156dec47ec0bec807c9ef5053b25d1c1f3159a034171d3d5e836a6997f3cba19e54ec92e6031343c0f96fd

Download Submit
memory/528-119-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/528-121-0x0000000000990000-0x0000000000CB0000-memory.dmp

Filesize
3.1MB

Download
memory/2556-120-0x0000000002370000-0x0000000002372000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing