Analysis
- max time kernel
142s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
30/03/2024, 00:46
General
- Target 2fa16ad56bddf430daf16b4fb71a3e35_JaffaCakes118.exe
- Size 727KB
- Sample240330-a4p8laea22
- SHA256 09b4fb11c410620d69ddc6caf95405f3d10005726c2953ac99f56547f81942b0
Malware Config
Extracted
-
xloader
-
2.5
-
iwtr
-
srikrishnadental.com
-
outthedoorinfive.com
-
batamgle.com
-
leela-13senses.com
-
iyhouse.space
-
brazzalb.com
-
camperinnrv.com
-
hageteruossan.com
-
alicepassion.com
-
wearethecardclinics.com
-
thenortherntechgroup.com
-
akademiarelacji.com
-
garu.club
-
brandscoop.net
-
ejassatulima.xyz
-
cdo-latam.com
-
noireimpactcollective.com
-
poquitotodo.com
-
g04urs14.com
-
mgytekstil.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fa16ad56bddf430daf16b4fb71a3e35_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2fa16ad56bddf430daf16b4fb71a3e35_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2fa16ad56bddf430daf16b4fb71a3e35_JaffaCakes118.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2824-0-0x0000000074710000-0x0000000074CC1000-memory.dmp
memory/2824-1-0x0000000074710000-0x0000000074CC1000-memory.dmp
memory/2824-2-0x0000000001440000-0x0000000001450000-memory.dmp
memory/2824-3-0x0000000074710000-0x0000000074CC1000-memory.dmp
memory/2824-4-0x0000000001440000-0x0000000001450000-memory.dmp
memory/2824-5-0x0000000001440000-0x0000000001450000-memory.dmp
memory/2824-8-0x0000000074710000-0x0000000074CC1000-memory.dmp
memory/3508-6-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3508-9-0x0000000001590000-0x00000000018DA000-memory.dmp