xloader | 15624bebe7e780932d151ba3b3a65ecd16b0762597a63b76e51f85c375261c10

Analysis

max time kernel
125s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2024, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
331c15b0107b096b2ccfbc4867c1e2f3_JaffaCakes118.exe
Size 554KB
Sample240330-elyt8shb69
SHA256 15624bebe7e780932d151ba3b3a65ecd16b0762597a63b76e51f85c375261c10
MD5 331c15b0107b096b2ccfbc4867c1e2f3
SHA1 c644a28a081f2ba43a3adc63cdd322f7769d5d23
SHA512 a968351a4ac257d72917e2f52c97a872d52eddd046a692a0d53ccdf3c9c2b1345ed138e9f2906a76beea7051f9584c73338b1b2350c150d84f704b69f265a378
SSDEEP 12288:XNsMDSBCYZjoEbWjKsJzABY4wkPMwmsc251OV:aFBCY+EZMzWYW9LG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xloader rca2 loader rat

Malware Config

Extracted

Family

xloader

Version

Campaign

rca2

Decoy

bapzcosmetics.com
skillsgage.com
mingshiweiye.com
dcc-compliance.com
emprenbook.com
firn.site
haryanaricemil.com
fleetwoodfoods.com
jlnxhbkj.com
surajsanyal.com
jubakey.com
auroraunitedshippingco.com
propolis-surabaya.com
vasinvestments.com
breederschallenge.com
tafcoo.com
417motoringparts.com
livemis.com
drainassist.com
kristenguestart.com
archangelhelicopters.com
theequitablebrands.com
ftbselect.com
rubberaspectroofing.co.uk
avonwear.com
bambourbon.com
bulukx.com
stocksuncovered.com
unazampanelcuore.com
fuckedupeverafter.com
laserawayspa.com
productosmigranjero.com
luxr-dubai.com
spiffyy.com
aldewanih1.com
representacionesiglesias.com
priceemall.com
smsinner.com
krakenupenterprises.com
sillysnarkysweet.com
calwestfinancing.com
thechoppingboard.net
nqpvyx.com
frankworks.art
digitalfilmdigest.com
duogong.net
ux300e.com
rockin-readers.com
dgjingqie.com
class-c-motorhomes.com
lendnehru.com
woeserey.club
habatomic.com
qlcdjsf.com
hotelconcepciobynobis.com
pmpmn.com
integralstatesproject.com
barbrareneebrighenti.com
siscomunicadocef2020.com
hulin.website
usaclisurvival.com
honeybee-benefits.com
150s1300e.com
sentenceswesay.com
zyn.info

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4648-5-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3068 set thread context of 4648	3068	331c15b0107b096b2ccfbc4867c1e2f3_JaffaCakes118.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4648	331c15b0107b096b2ccfbc4867c1e2f3_JaffaCakes118.exe
4648	331c15b0107b096b2ccfbc4867c1e2f3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 4648	3068	331c15b0107b096b2ccfbc4867c1e2f3_JaffaCakes118.exe	90
PID 3068 wrote to memory of 4648	3068	331c15b0107b096b2ccfbc4867c1e2f3_JaffaCakes118.exe	90
PID 3068 wrote to memory of 4648	3068	331c15b0107b096b2ccfbc4867c1e2f3_JaffaCakes118.exe	90
PID 3068 wrote to memory of 4648	3068	331c15b0107b096b2ccfbc4867c1e2f3_JaffaCakes118.exe	90
PID 3068 wrote to memory of 4648	3068	331c15b0107b096b2ccfbc4867c1e2f3_JaffaCakes118.exe	90
PID 3068 wrote to memory of 4648	3068	331c15b0107b096b2ccfbc4867c1e2f3_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\331c15b0107b096b2ccfbc4867c1e2f3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\331c15b0107b096b2ccfbc4867c1e2f3_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\331c15b0107b096b2ccfbc4867c1e2f3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\331c15b0107b096b2ccfbc4867c1e2f3_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3068-0-0x0000000074870000-0x0000000074E21000-memory.dmp

Download

memory/3068-1-0x0000000001420000-0x0000000001430000-memory.dmp

Download

memory/3068-2-0x0000000074870000-0x0000000074E21000-memory.dmp

Download

memory/3068-3-0x0000000074870000-0x0000000074E21000-memory.dmp

Download

memory/3068-4-0x0000000001420000-0x0000000001430000-memory.dmp

Download

memory/3068-7-0x0000000074870000-0x0000000074E21000-memory.dmp

Download

memory/4648-5-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4648-8-0x0000000001100000-0x000000000144A000-memory.dmp

Download

memory/4648-9-0x0000000001100000-0x000000000144A000-memory.dmp

Download