xloader | a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e

General

Target

a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe
Size

409KB
MD5

f245bc7fd14a989b83c7dd40f78733f3
SHA1

26de0fe1f99e50859715040901c7303a15a9cf39
SHA256

a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e
SHA512

403e049996b10654fe9ffc48512d5ff8ebe93976519996010e40447da9fb57608e8677d6ab77d4f52a07b92eba1ef685b95d5a84c82571a32b72cf4700987322

Score

10^/10

xloader pnug loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3756-119-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe

pid process

3964 a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe

pid	process
3964	a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe

description	pid	process	target process
PID 3964 set thread context of 3756	3964	a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe	a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe

pid	process
3756	a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe
3756	a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe

description	pid	process	target process
PID 3964 wrote to memory of 3756	3964	a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe	a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe
PID 3964 wrote to memory of 3756	3964	a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe	a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe
PID 3964 wrote to memory of 3756	3964	a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe	a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe
PID 3964 wrote to memory of 3756	3964	a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe	a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe
PID 3964 wrote to memory of 3756	3964	a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe	a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe
PID 3964 wrote to memory of 3756	3964	a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe	a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe

C:\Users\Admin\AppData\Local\Temp\a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe
"C:\Users\Admin\AppData\Local\Temp\a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3964

C:\Users\Admin\AppData\Local\Temp\a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe
"C:\Users\Admin\AppData\Local\Temp\a1bf6120b566e76d3df3b722c1a517fe69b74e670d70bde100c4cf04e3ee947e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsq3769.tmp\ldujgkplvbo.dll
MD5
96ad57430e52d77e26262eba58a2a3df

SHA1
a50a8b18fd5959eb755b5eacbcc85606224df76f

SHA256
502d7a72104adf90047597f47a4ce6e5ed17769ad684c51755257d285519ebc5

SHA512
cb200b5fece25d1de9693178bac8d1ba0cf18f26a612d44b079a8b4a099a1db0fa73ef92707bb18212b80fba0c57ac042964f4816919b798bb5fea43152c513b

Download Submit
memory/3756-119-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/3756-121-0x0000000000AE0000-0x0000000000E00000-memory.dmp

Filesize
3.1MB

Download
memory/3964-120-0x00000000022D0000-0x00000000022D2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads