Analysis
- max time kernel
142s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
29/03/2024, 01:46
General
- Target 15761e9ba324afabc885b859241a5f87_JaffaCakes118.exe
- Size 846KB
- Sample240329-b7fc8seh35
- SHA256 68f62a1a2f9d6ae1b6b8e4ce42105b8ba0f41ae1f93f3b8de733b63fda990994
Malware Config
Extracted
-
xloader
-
2.5
-
b4cq
-
movementformamas.com
-
carijualpt.com
-
lasochlarm.mobi
-
neoletica.com
-
laylaleebell.com
-
szcczl.com
-
blackicezone.club
-
onlyconference.com
-
812ecarriage1.info
-
kelloscreations.com
-
atozibs.com
-
swaytheredelilah.com
-
rsdeloitte.com
-
uiccychy.xyz
-
nuocsucmienghoanghuong.group
-
thehomeeguide.com
-
cityrideexpress.com
-
just-flyflights.com
-
rental-aruyo.com
-
vivamexicopa.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\15761e9ba324afabc885b859241a5f87_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\15761e9ba324afabc885b859241a5f87_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\15761e9ba324afabc885b859241a5f87_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\15761e9ba324afabc885b859241a5f87_JaffaCakes118.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\15761e9ba324afabc885b859241a5f87_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\15761e9ba324afabc885b859241a5f87_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3592 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2552-12-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2552-13-0x0000000001A10000-0x0000000001D5A000-memory.dmp
memory/4616-6-0x00000000054C0000-0x00000000054CA000-memory.dmp
memory/4616-3-0x00000000050A0000-0x0000000005132000-memory.dmp
memory/4616-4-0x0000000074E00000-0x00000000755B0000-memory.dmp
memory/4616-5-0x0000000005070000-0x0000000005080000-memory.dmp
memory/4616-0-0x0000000074E00000-0x00000000755B0000-memory.dmp
memory/4616-7-0x0000000005500000-0x000000000551C000-memory.dmp
memory/4616-8-0x0000000005D00000-0x0000000005D18000-memory.dmp
memory/4616-9-0x0000000005070000-0x0000000005080000-memory.dmp
memory/4616-10-0x0000000008200000-0x000000000829C000-memory.dmp
memory/4616-11-0x0000000000F50000-0x0000000000FB8000-memory.dmp
memory/4616-2-0x0000000005650000-0x0000000005BF4000-memory.dmp
memory/4616-1-0x00000000005F0000-0x00000000006CA000-memory.dmp
memory/4616-15-0x0000000074E00000-0x00000000755B0000-memory.dmp