xloader | 1b77ac028b4a0c0c9262c945bb5480ec1bbfa3503b547fd11d34735d87245548

General

Target

tmp.exe
Size

454KB
MD5

c23297d589c6a9806eb81019b2c9eb3b
SHA1

f5881870b7fdebdad9b760f12b8875cd2fa0be21
SHA256

1b77ac028b4a0c0c9262c945bb5480ec1bbfa3503b547fd11d34735d87245548
SHA512

20ce29047049c33d51fcd84961bbad6890527e1debf76ff783b5207c5f86e823c502c7d74e23706c2ce505e8eb39aa8379486957bcb0739a56cc4cff8dd47224

Score

10^/10

xloader pnug loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/664-57-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/664-59-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1848-65-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

932 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

tmp.exe

pid process

1224 tmp.exe

pid	process
932	cmd.exe

pid	process
1224	tmp.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

tmp.exetmp.exehelp.exe

description	pid	process	target process
PID 1224 set thread context of 664	1224	tmp.exe	tmp.exe
PID 664 set thread context of 1416	664	tmp.exe	Explorer.EXE
PID 1848 set thread context of 1416	1848	help.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

tmp.exehelp.exe

pid	process
664	tmp.exe
664	tmp.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe
1848	help.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1416 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

tmp.exehelp.exe

pid process

664 tmp.exe
664 tmp.exe
664 tmp.exe
1848 help.exe
1848 help.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tmp.exehelp.exe

description pid process

Token: SeDebugPrivilege 664 tmp.exe
Token: SeDebugPrivilege 1848 help.exe

pid	process
1416	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	664	tmp.exe
Token: SeDebugPrivilege	1848	help.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

tmp.exeExplorer.EXEhelp.exe

description	pid	process	target process
PID 1224 wrote to memory of 664	1224	tmp.exe	tmp.exe
PID 1224 wrote to memory of 664	1224	tmp.exe	tmp.exe
PID 1224 wrote to memory of 664	1224	tmp.exe	tmp.exe
PID 1224 wrote to memory of 664	1224	tmp.exe	tmp.exe
PID 1224 wrote to memory of 664	1224	tmp.exe	tmp.exe
PID 1224 wrote to memory of 664	1224	tmp.exe	tmp.exe
PID 1224 wrote to memory of 664	1224	tmp.exe	tmp.exe
PID 1416 wrote to memory of 1848	1416	Explorer.EXE	help.exe
PID 1416 wrote to memory of 1848	1416	Explorer.EXE	help.exe
PID 1416 wrote to memory of 1848	1416	Explorer.EXE	help.exe
PID 1416 wrote to memory of 1848	1416	Explorer.EXE	help.exe
PID 1848 wrote to memory of 932	1848	help.exe	cmd.exe
PID 1848 wrote to memory of 932	1848	help.exe	cmd.exe
PID 1848 wrote to memory of 932	1848	help.exe	cmd.exe
PID 1848 wrote to memory of 932	1848	help.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1416

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1224

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:664

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
3⤵
- Deletes itself
PID:932

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsd18EF.tmp\dizovdsybw.dll
MD5
5f20dd330771ce1f940c7e7bd9387a4e

SHA1
3c9e98fc0f1a295b7223d2257bc9b6fa60db0863

SHA256
770bd65aae4622101ff91ad1beccfb4e7edc20f175b0303eb6d37efa2c5c582f

SHA512
0eda4b68a7e1a1cbc3c5952d0bdc6c19423f23dcd9f14b83bd3f82e17bca2ce5fbdae4839e3014a21f1afa014d6b59c997cc7e9a86d9fbe8bc31f504eed583c1

Download Submit
memory/664-61-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/664-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/664-59-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/664-60-0x0000000000730000-0x0000000000A33000-memory.dmp

Filesize
3.0MB

Download
memory/664-62-0x0000000000340000-0x0000000000351000-memory.dmp

Filesize
68KB

Download
memory/1224-56-0x0000000001DF0000-0x0000000001DF2000-memory.dmp

Filesize
8KB

Download
memory/1224-54-0x0000000076A01000-0x0000000076A03000-memory.dmp

Filesize
8KB

Download
memory/1416-63-0x00000000068A0000-0x00000000069AB000-memory.dmp

Filesize
1.0MB

Download
memory/1416-68-0x0000000008C30000-0x0000000008D4B000-memory.dmp

Filesize
1.1MB

Download
memory/1848-64-0x0000000000BC0000-0x0000000000BC6000-memory.dmp

Filesize
24KB

Download
memory/1848-65-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/1848-66-0x00000000007B0000-0x0000000000AB3000-memory.dmp

Filesize
3.0MB

Download
memory/1848-67-0x00000000004E0000-0x0000000000570000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads