Analysis
- max time kernel
147s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
29/03/2024, 18:46
General
- Target 29e7355c628a7a78b16352716e91478e_JaffaCakes118.exe
- Size 382KB
- Sample240329-xerfpafg86
- SHA256 88bb9d0ecb52c0d5a024287caa7bdf03502ed536728988e6af7290399c873cb4
Malware Config
Extracted
-
xloader
-
2.5
-
u4an
-
charlottesbestroofcompany.com
-
gxzcgl.com
-
easyprints.xyz
-
hitmanautomation.com
-
play-to-escape.com
-
beansmagic.com
-
lianxiwan.xyz
-
nuhive.net
-
whystake.com
-
n6h65.online
-
emergencyprep4cast.com
-
peolinks.com
-
8ls-world.com
-
tezportal.net
-
trych.net
-
bathrobeconnection.com
-
quinnwebster.top
-
sagarmakhija.online
-
ladiesgossiping.com
-
400doultonct.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\29e7355c628a7a78b16352716e91478e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\29e7355c628a7a78b16352716e91478e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\29e7355c628a7a78b16352716e91478e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\29e7355c628a7a78b16352716e91478e_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2904-11-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2904-14-0x0000000001560000-0x00000000018AA000-memory.dmp
memory/4984-6-0x00000000051E0000-0x00000000051EE000-memory.dmp
memory/4984-3-0x0000000004B50000-0x0000000004BE2000-memory.dmp
memory/4984-4-0x0000000004D30000-0x0000000004D40000-memory.dmp
memory/4984-5-0x0000000004B40000-0x0000000004B4A000-memory.dmp
memory/4984-0-0x0000000000110000-0x0000000000176000-memory.dmp
memory/4984-7-0x0000000075150000-0x0000000075900000-memory.dmp
memory/4984-8-0x0000000004D30000-0x0000000004D40000-memory.dmp
memory/4984-9-0x0000000007740000-0x00000000077DC000-memory.dmp
memory/4984-10-0x00000000077E0000-0x0000000007832000-memory.dmp
memory/4984-2-0x0000000005200000-0x00000000057A4000-memory.dmp
memory/4984-13-0x0000000075150000-0x0000000075900000-memory.dmp
memory/4984-1-0x0000000075150000-0x0000000075900000-memory.dmp