xloader | 1b77ac028b4a0c0c9262c945bb5480ec1bbfa3503b547fd11d34735d87245548

General

Target

tmp.exe
Size

454KB
MD5

c23297d589c6a9806eb81019b2c9eb3b
SHA1

f5881870b7fdebdad9b760f12b8875cd2fa0be21
SHA256

1b77ac028b4a0c0c9262c945bb5480ec1bbfa3503b547fd11d34735d87245548
SHA512

20ce29047049c33d51fcd84961bbad6890527e1debf76ff783b5207c5f86e823c502c7d74e23706c2ce505e8eb39aa8379486957bcb0739a56cc4cff8dd47224

Score

10^/10

xloader pnug loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2452-131-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/2452-134-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/2452-138-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral2/memory/3804-142-0x0000000000B20000-0x0000000000B49000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

Processes:

tmp.exe

pid process

1932 tmp.exe

pid	process
1932	tmp.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

tmp.exetmp.execmmon32.exe

description	pid	process	target process
PID 1932 set thread context of 2452	1932	tmp.exe	tmp.exe
PID 2452 set thread context of 3024	2452	tmp.exe	Explorer.EXE
PID 2452 set thread context of 3024	2452	tmp.exe	Explorer.EXE
PID 3804 set thread context of 3024	3804	cmmon32.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

tmp.execmmon32.exe

pid	process
2452	tmp.exe
2452	tmp.exe
2452	tmp.exe
2452	tmp.exe
2452	tmp.exe
2452	tmp.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe
3804	cmmon32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3024 Explorer.EXE
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

tmp.execmmon32.exe

pid process

2452 tmp.exe
2452 tmp.exe
2452 tmp.exe
2452 tmp.exe
3804 cmmon32.exe
3804 cmmon32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tmp.execmmon32.exe

description pid process

Token: SeDebugPrivilege 2452 tmp.exe
Token: SeDebugPrivilege 3804 cmmon32.exe

pid	process
3024	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	2452	tmp.exe
Token: SeDebugPrivilege	3804	cmmon32.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

tmp.exeExplorer.EXEcmmon32.exe

description	pid	process	target process
PID 1932 wrote to memory of 2452	1932	tmp.exe	tmp.exe
PID 1932 wrote to memory of 2452	1932	tmp.exe	tmp.exe
PID 1932 wrote to memory of 2452	1932	tmp.exe	tmp.exe
PID 1932 wrote to memory of 2452	1932	tmp.exe	tmp.exe
PID 1932 wrote to memory of 2452	1932	tmp.exe	tmp.exe
PID 1932 wrote to memory of 2452	1932	tmp.exe	tmp.exe
PID 3024 wrote to memory of 3804	3024	Explorer.EXE	cmmon32.exe
PID 3024 wrote to memory of 3804	3024	Explorer.EXE	cmmon32.exe
PID 3024 wrote to memory of 3804	3024	Explorer.EXE	cmmon32.exe
PID 3804 wrote to memory of 3272	3804	cmmon32.exe	cmd.exe
PID 3804 wrote to memory of 3272	3804	cmmon32.exe	cmd.exe
PID 3804 wrote to memory of 3272	3804	cmmon32.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3024

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3804

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
3⤵
PID:3272

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsc37E8.tmp\dizovdsybw.dll
MD5
5f20dd330771ce1f940c7e7bd9387a4e

SHA1
3c9e98fc0f1a295b7223d2257bc9b6fa60db0863

SHA256
770bd65aae4622101ff91ad1beccfb4e7edc20f175b0303eb6d37efa2c5c582f

SHA512
0eda4b68a7e1a1cbc3c5952d0bdc6c19423f23dcd9f14b83bd3f82e17bca2ce5fbdae4839e3014a21f1afa014d6b59c997cc7e9a86d9fbe8bc31f504eed583c1

Download Submit
memory/2452-138-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2452-133-0x0000000000BA0000-0x0000000000EEA000-memory.dmp

Filesize
3.3MB

Download
memory/2452-134-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2452-135-0x00000000005C0000-0x00000000005D1000-memory.dmp

Filesize
68KB

Download
memory/2452-131-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2452-139-0x0000000000B40000-0x0000000000B51000-memory.dmp

Filesize
68KB

Download
memory/3024-136-0x0000000008710000-0x00000000087F7000-memory.dmp

Filesize
924KB

Download
memory/3024-140-0x0000000008800000-0x0000000008968000-memory.dmp

Filesize
1.4MB

Download
memory/3024-145-0x0000000003360000-0x0000000003451000-memory.dmp

Filesize
964KB

Download
memory/3804-142-0x0000000000B20000-0x0000000000B49000-memory.dmp

Filesize
164KB

Download
memory/3804-141-0x0000000000A80000-0x0000000000A8C000-memory.dmp

Filesize
48KB

Download
memory/3804-143-0x0000000002C00000-0x0000000002F4A000-memory.dmp

Filesize
3.3MB

Download
memory/3804-144-0x0000000002A20000-0x0000000002AB0000-memory.dmp

Filesize
576KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads