xloader | b17b8be05fc8389990be623a727369826383bfc2fb33693943f208faa184ff40

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/03/2024, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe
Size 253KB
Sample240330-d2vbbaga8v
SHA256 b17b8be05fc8389990be623a727369826383bfc2fb33693943f208faa184ff40
MD5 326879d0158d92efc02be27a534e2af4
SHA1 f0a4055436bf4ab684f0ff38a0af2d87ef792069
SHA512 950cc47ac43379abe7ba63de202543748d414969f48996e5e7082eaf79f27c9767980354c0483803881cbe88ccbee18a28037d04142274ff2aa14a394003a389
SSDEEP 6144:wBlL/cwA22vGb3UX6hyXVBG1amR0wlWg+BYazEzjAQBc:CewAFX6koamR0wtNi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xloader u5eh loader rat

Malware Config

Extracted

Family

xloader

Version

Campaign

u5eh

Decoy

tryafaq.com
bobcathntshop.com
oglead.com
026skz.xyz
brasbux.com
adna17.com
noveltyrofjiy.xyz
realestatecompanys.com
leman-web.com
df5686.com
jonathonhawkins.com
juliedominyfloralartistry.com
classyeventsco.com
aquaticatt.com
iotworld.xyz
hoc8.com
disposablediapers.store
peregovorim.online
advancebits.club
getaburialplan.com
tiger-trails.com
dnbaba.com
492981.com
eclipse-electrical-euless.com
cassandracchase.com
healthrightmeds.club
permkray.club
tawazoun-dz.com
extrabladet.com
offmanage.com
peoplexplants.com
mumkungiyim.com
personal-email-office-mgt.com
bjmysa.com
hopshomes.com
cnj-power.com
trendproduct.tech
chauffeuredaustralia.online
176ssjp0033.xyz
52juns.com
rewriringcanada.com
seabourneboats.com
sevensummittrek.com
retalent.agency
lz4ios.cloud
mindandbodyalignment.com
bedrijfmail-trk.com
bashmoney.net
xc3654.com
infiteltech.com
sh-hywz.com
huataiqche.com
grannyh.com
devinwithani.com
kingstons.info
fakedocshyundaigiveaway.com
bigsyncmusic.info
predstavnuk.com
frontiervalley8.com
timdpr.com
smartgymadmin.com
brsgeniusschool.com
tuckertractorworks.com
espchange.com
retonamoss.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2936-8-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 2 IoCs

pid	Process
1912	326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe
2504	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1912 set thread context of 2936	1912	326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2504	1912	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2936	326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2936	1912	326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe	28
PID 1912 wrote to memory of 2936	1912	326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe	28
PID 1912 wrote to memory of 2936	1912	326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe	28
PID 1912 wrote to memory of 2936	1912	326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe	28
PID 1912 wrote to memory of 2936	1912	326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe	28
PID 1912 wrote to memory of 2936	1912	326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe	28
PID 1912 wrote to memory of 2936	1912	326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe	28
PID 1912 wrote to memory of 2504	1912	326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe	29
PID 1912 wrote to memory of 2504	1912	326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe	29
PID 1912 wrote to memory of 2504	1912	326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe	29
PID 1912 wrote to memory of 2504	1912	326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Users\Admin\AppData\Local\Temp\326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\326879d0158d92efc02be27a534e2af4_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 492
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jmmnbh.dll

Path \Users\Admin\AppData\Local\Temp\nsoB77.tmp\jmmnbh.dll
Size 33KB
SHA256 f0ed5b1f290b36168d3cdce44b29a92dde64b558b350576431983f902fedeb8e
MD5 3fe6933172cb97cd2f22413f795660ba
SHA1 1ee9dfeb2329eb108ec654db3e87f1e698e0e731
SHA512 e946a1b33031678108f325d4464b6fd6ff889cd397c2eb2e51347f0a9e33d3837ca2b020cfb9d34bd24ae7a4864b0549f2ab97fc560f39f00c0b82b17f054052
SSDEEP 384:Io2inGgH1YPO7bfcWHRiMc9Zwg/XpvK5X/XJm5d/rgjQrX+dtWJdYLeWU9TkNNWt:H26j710wxO/rgjQrYtWLoSYlPz+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2936-8-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2936-11-0x0000000000860000-0x0000000000B63000-memory.dmp

Download