xloader | 1b77ac028b4a0c0c9262c945bb5480ec1bbfa3503b547fd11d34735d87245548

General

Target

tmp.exe
Size

454KB
MD5

c23297d589c6a9806eb81019b2c9eb3b
SHA1

f5881870b7fdebdad9b760f12b8875cd2fa0be21
SHA256

1b77ac028b4a0c0c9262c945bb5480ec1bbfa3503b547fd11d34735d87245548
SHA512

20ce29047049c33d51fcd84961bbad6890527e1debf76ff783b5207c5f86e823c502c7d74e23706c2ce505e8eb39aa8379486957bcb0739a56cc4cff8dd47224

Score

10^/10

xloader pnug loader rat suricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1324-131-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/400-138-0x0000000002F60000-0x0000000002F89000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

tmp.exe

pid process

3964 tmp.exe

pid	process
3964	tmp.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

tmp.exetmp.exehelp.exe

description	pid	process	target process
PID 3964 set thread context of 1324	3964	tmp.exe	tmp.exe
PID 1324 set thread context of 2456	1324	tmp.exe	Explorer.EXE
PID 400 set thread context of 2456	400	help.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

tmp.exehelp.exe

pid	process
1324	tmp.exe
1324	tmp.exe
1324	tmp.exe
1324	tmp.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe
400	help.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2456 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

tmp.exehelp.exe

pid process

1324 tmp.exe
1324 tmp.exe
1324 tmp.exe
400 help.exe
400 help.exe

pid	process
2456	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tmp.exehelp.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	1324	tmp.exe
Token: SeDebugPrivilege	400	help.exe
Token: SeShutdownPrivilege	2456	Explorer.EXE
Token: SeCreatePagefilePrivilege	2456	Explorer.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

tmp.exeExplorer.EXEhelp.exe

description	pid	process	target process
PID 3964 wrote to memory of 1324	3964	tmp.exe	tmp.exe
PID 3964 wrote to memory of 1324	3964	tmp.exe	tmp.exe
PID 3964 wrote to memory of 1324	3964	tmp.exe	tmp.exe
PID 3964 wrote to memory of 1324	3964	tmp.exe	tmp.exe
PID 3964 wrote to memory of 1324	3964	tmp.exe	tmp.exe
PID 3964 wrote to memory of 1324	3964	tmp.exe	tmp.exe
PID 2456 wrote to memory of 400	2456	Explorer.EXE	help.exe
PID 2456 wrote to memory of 400	2456	Explorer.EXE	help.exe
PID 2456 wrote to memory of 400	2456	Explorer.EXE	help.exe
PID 400 wrote to memory of 3964	400	help.exe	cmd.exe
PID 400 wrote to memory of 3964	400	help.exe	cmd.exe
PID 400 wrote to memory of 3964	400	help.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3964

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1324

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
3⤵
PID:3964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsr1B43.tmp\dizovdsybw.dll
MD5
5f20dd330771ce1f940c7e7bd9387a4e

SHA1
3c9e98fc0f1a295b7223d2257bc9b6fa60db0863

SHA256
770bd65aae4622101ff91ad1beccfb4e7edc20f175b0303eb6d37efa2c5c582f

SHA512
0eda4b68a7e1a1cbc3c5952d0bdc6c19423f23dcd9f14b83bd3f82e17bca2ce5fbdae4839e3014a21f1afa014d6b59c997cc7e9a86d9fbe8bc31f504eed583c1

Download Submit
memory/400-137-0x0000000000360000-0x0000000000367000-memory.dmp

Filesize
28KB

Download
memory/400-138-0x0000000002F60000-0x0000000002F89000-memory.dmp

Filesize
164KB

Download
memory/400-139-0x0000000003990000-0x0000000003CDA000-memory.dmp

Filesize
3.3MB

Download
memory/400-140-0x00000000036A0000-0x0000000003730000-memory.dmp

Filesize
576KB

Download
memory/1324-131-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1324-134-0x000000000041D000-0x000000000041E000-memory.dmp

Filesize
4KB

Download
memory/1324-133-0x0000000000A40000-0x0000000000D8A000-memory.dmp

Filesize
3.3MB

Download
memory/1324-135-0x00000000009E0000-0x00000000009F1000-memory.dmp

Filesize
68KB

Download
memory/2456-136-0x0000000009110000-0x000000000924C000-memory.dmp

Filesize
1.2MB

Download
memory/2456-141-0x0000000008FF0000-0x00000000090D3000-memory.dmp

Filesize
908KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads