xloader | 832c65a202ec1c69a8297af3d2fc3d233ac65b7c2c670f30d0694089601c9cfe

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2024 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe
Size

585KB
MD5

4d10925c2d52223135b1a2e069bc5ab0
SHA1

1eb2a075efe3f17fecfdd9d4cc5d39266e5cd162
SHA256

832c65a202ec1c69a8297af3d2fc3d233ac65b7c2c670f30d0694089601c9cfe
SHA512

7708579ba479c687705cec9ed5eb9d0ef30339c8cb50d18677d00f05fb37f403fbf56d8101ba9dd93a8216d1ee316e07ae4bb2667feab0ee889e06bff810164a
SSDEEP

12288:j+3bUfN/EH056Nvdg0nRrR9rWWy+vdLlOhsxeHH:HC0YtqGvWVapOyxen

Score

10^/10

xloader fqiq loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

fqiq

Decoy

driventow.com

ipatchwork.today

bolder.equipment

seal-brother.com

mountlaketerraceapartments.com

weeden.xyz

sanlifalan.com

athafood.com

isshinn1.com

creationslazzaroni.com

eclecticrenaissancewoman.com

satellitephonstore.com

cotchildcare.com

yamacorp.digital

ff4cuno43.xyz

quicksticks.community

govindfinance.com

farmersfirstseed.com

megacinema.club

tablescaperendezvous4two.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1116-11-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe

description	pid	process	target process
PID 760 set thread context of 1116	760	4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe	4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe

pid process

1116 4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe
1116 4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe

pid	process
1116	4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe
1116	4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe

description	pid	process	target process
PID 760 wrote to memory of 1116	760	4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe	4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe
PID 760 wrote to memory of 1116	760	4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe	4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe
PID 760 wrote to memory of 1116	760	4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe	4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe
PID 760 wrote to memory of 1116	760	4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe	4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe
PID 760 wrote to memory of 1116	760	4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe	4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe
PID 760 wrote to memory of 1116	760	4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe	4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:760

C:\Users\Admin\AppData\Local\Temp\4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4d10925c2d52223135b1a2e069bc5ab0_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/760-6-0x0000000005EB0000-0x0000000005ECC000-memory.dmp

Filesize
112KB

Download
memory/760-0-0x0000000000240000-0x00000000002D8000-memory.dmp

Filesize
608KB

Download
memory/760-2-0x00000000051D0000-0x0000000005774000-memory.dmp

Filesize
5.6MB

Download
memory/760-3-0x0000000004CC0000-0x0000000004D52000-memory.dmp

Filesize
584KB

Download
memory/760-4-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/760-5-0x0000000004CB0000-0x0000000004CBA000-memory.dmp

Filesize
40KB

Download
memory/760-1-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download
memory/760-7-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download
memory/760-10-0x00000000063E0000-0x0000000006432000-memory.dmp

Filesize
328KB

Download
memory/760-9-0x00000000062F0000-0x000000000638C000-memory.dmp

Filesize
624KB

Download
memory/760-8-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/760-13-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download
memory/1116-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1116-14-0x0000000001670000-0x00000000019BA000-memory.dmp

Filesize
3.3MB

Download