xloader | f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb

General

Target

f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe
Size

1016KB
MD5

7e3921b7ae79096c45b6545d8c26273c
SHA1

3b05c2712309dbc878ad3051fc11f4609eb31a6c
SHA256

f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb
SHA512

5a0dc4ec4504f44fff5fd68e5f6cf5611880178692b8815cfe055130f86dc2e7c02274b892eac45c5f82ec0aa10e3239460b98b25a53d9fc261ed041d37581c6

Score

10^/10

xloader pnug loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2948-123-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe

description	pid	process	target process
PID 3704 set thread context of 2948	3704	f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe	f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe

pid	process
2948	f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe
2948	f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe

description	pid	process	target process
PID 3704 wrote to memory of 2948	3704	f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe	f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe
PID 3704 wrote to memory of 2948	3704	f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe	f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe
PID 3704 wrote to memory of 2948	3704	f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe	f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe
PID 3704 wrote to memory of 2948	3704	f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe	f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe
PID 3704 wrote to memory of 2948	3704	f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe	f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe
PID 3704 wrote to memory of 2948	3704	f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe	f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe

C:\Users\Admin\AppData\Local\Temp\f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe
"C:\Users\Admin\AppData\Local\Temp\f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3704

C:\Users\Admin\AppData\Local\Temp\f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe
"C:\Users\Admin\AppData\Local\Temp\f1d8d7b78bd6e53b4cfa63bc4f03ec0c9d7baad72c0e697993fd3354df4ab0fb.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2948

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2948-123-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2948-124-0x0000000000F60000-0x0000000001280000-memory.dmp

Filesize
3.1MB

Download
memory/3704-115-0x0000000000420000-0x0000000000526000-memory.dmp

Filesize
1.0MB

Download
memory/3704-116-0x0000000005390000-0x000000000588E000-memory.dmp

Filesize
5.0MB

Download
memory/3704-117-0x0000000004F30000-0x0000000004FC2000-memory.dmp

Filesize
584KB

Download
memory/3704-118-0x0000000004EB0000-0x0000000004EBA000-memory.dmp

Filesize
40KB

Download
memory/3704-119-0x0000000004E90000-0x000000000538E000-memory.dmp

Filesize
5.0MB

Download
memory/3704-120-0x00000000050F0000-0x00000000050FC000-memory.dmp

Filesize
48KB

Download
memory/3704-121-0x00000000078D0000-0x000000000796C000-memory.dmp

Filesize
624KB

Download
memory/3704-122-0x0000000007B50000-0x0000000007BAE000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads