xloader | 1b77ac028b4a0c0c9262c945bb5480ec1bbfa3503b547fd11d34735d87245548

General

Target

tmp.exe
Size

454KB
MD5

c23297d589c6a9806eb81019b2c9eb3b
SHA1

f5881870b7fdebdad9b760f12b8875cd2fa0be21
SHA256

1b77ac028b4a0c0c9262c945bb5480ec1bbfa3503b547fd11d34735d87245548
SHA512

20ce29047049c33d51fcd84961bbad6890527e1debf76ff783b5207c5f86e823c502c7d74e23706c2ce505e8eb39aa8379486957bcb0739a56cc4cff8dd47224

Score

10^/10

xloader pnug loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1680-57-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1680-59-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/516-64-0x0000000000080000-0x00000000000A9000-memory.dmp	xloader

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1356 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

tmp.exe

pid process

948 tmp.exe

pid	process
1356	cmd.exe

pid	process
948	tmp.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

tmp.exetmp.exehelp.exe

description	pid	process	target process
PID 948 set thread context of 1680	948	tmp.exe	tmp.exe
PID 1680 set thread context of 1344	1680	tmp.exe	Explorer.EXE
PID 516 set thread context of 1344	516	help.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

tmp.exehelp.exe

pid	process
1680	tmp.exe
1680	tmp.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe
516	help.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1344 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

tmp.exehelp.exe

pid process

1680 tmp.exe
1680 tmp.exe
1680 tmp.exe
516 help.exe
516 help.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tmp.exehelp.exe

description pid process

Token: SeDebugPrivilege 1680 tmp.exe
Token: SeDebugPrivilege 516 help.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1344 Explorer.EXE
1344 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1344 Explorer.EXE
1344 Explorer.EXE

pid	process
1344	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	1680	tmp.exe
Token: SeDebugPrivilege	516	help.exe

pid	process
1344	Explorer.EXE
1344	Explorer.EXE

pid	process
1344	Explorer.EXE
1344	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

tmp.exeExplorer.EXEhelp.exe

description	pid	process	target process
PID 948 wrote to memory of 1680	948	tmp.exe	tmp.exe
PID 948 wrote to memory of 1680	948	tmp.exe	tmp.exe
PID 948 wrote to memory of 1680	948	tmp.exe	tmp.exe
PID 948 wrote to memory of 1680	948	tmp.exe	tmp.exe
PID 948 wrote to memory of 1680	948	tmp.exe	tmp.exe
PID 948 wrote to memory of 1680	948	tmp.exe	tmp.exe
PID 948 wrote to memory of 1680	948	tmp.exe	tmp.exe
PID 1344 wrote to memory of 516	1344	Explorer.EXE	help.exe
PID 1344 wrote to memory of 516	1344	Explorer.EXE	help.exe
PID 1344 wrote to memory of 516	1344	Explorer.EXE	help.exe
PID 1344 wrote to memory of 516	1344	Explorer.EXE	help.exe
PID 516 wrote to memory of 1356	516	help.exe	cmd.exe
PID 516 wrote to memory of 1356	516	help.exe	cmd.exe
PID 516 wrote to memory of 1356	516	help.exe	cmd.exe
PID 516 wrote to memory of 1356	516	help.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:948

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:516

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
3⤵
- Deletes itself
PID:1356

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst346B.tmp\dizovdsybw.dll
MD5
5f20dd330771ce1f940c7e7bd9387a4e

SHA1
3c9e98fc0f1a295b7223d2257bc9b6fa60db0863

SHA256
770bd65aae4622101ff91ad1beccfb4e7edc20f175b0303eb6d37efa2c5c582f

SHA512
0eda4b68a7e1a1cbc3c5952d0bdc6c19423f23dcd9f14b83bd3f82e17bca2ce5fbdae4839e3014a21f1afa014d6b59c997cc7e9a86d9fbe8bc31f504eed583c1

Download Submit
memory/516-64-0x0000000000080000-0x00000000000A9000-memory.dmp

Filesize
164KB

Download
memory/516-66-0x0000000000530000-0x00000000005C0000-memory.dmp

Filesize
576KB

Download
memory/516-65-0x0000000000770000-0x0000000000A73000-memory.dmp

Filesize
3.0MB

Download
memory/516-63-0x0000000000C50000-0x0000000000C56000-memory.dmp

Filesize
24KB

Download
memory/948-56-0x0000000000460000-0x0000000000462000-memory.dmp

Filesize
8KB

Download
memory/948-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1344-67-0x0000000004DE0000-0x0000000004EE9000-memory.dmp

Filesize
1.0MB

Download
memory/1344-62-0x0000000003E50000-0x0000000003F43000-memory.dmp

Filesize
972KB

Download
memory/1680-57-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1680-61-0x00000000002C0000-0x00000000002D1000-memory.dmp

Filesize
68KB

Download
memory/1680-60-0x0000000000930000-0x0000000000C33000-memory.dmp

Filesize
3.0MB

Download
memory/1680-59-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads