xloader | 092be1f456b0c24d932d6c4e4c44cfd0c9abc6c0418bf1567e67826cb51aef14

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2024 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe
Size

569KB
MD5

51dcc89ed1035a6c2fc57ada8dcb4dc2
SHA1

0e59efbffdd8153c61f20a6039110474c50c20e9
SHA256

092be1f456b0c24d932d6c4e4c44cfd0c9abc6c0418bf1567e67826cb51aef14
SHA512

a485e5a4cfb47867d00bc9ace1848d8859274f0c2987e8b46e53fc7086f1af6e53f92e33a17ac66b782641ca77bd91f56d32f40d952bb4df08920273e5e05fe6
SSDEEP

12288:IQSB6F/pLLbTHFw1WufwltdYYXsOaCnuNQpFINwgNP1:IdBS/lbTHu1WuovdYoayuNrNt

Score

10^/10

xloader fqiq loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

fqiq

Decoy

driventow.com

ipatchwork.today

bolder.equipment

seal-brother.com

mountlaketerraceapartments.com

weeden.xyz

sanlifalan.com

athafood.com

isshinn1.com

creationslazzaroni.com

eclecticrenaissancewoman.com

satellitephonstore.com

cotchildcare.com

yamacorp.digital

ff4cuno43.xyz

quicksticks.community

govindfinance.com

farmersfirstseed.com

megacinema.club

tablescaperendezvous4two.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1660-11-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe

description	pid	process	target process
PID 3560 set thread context of 1660	3560	51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe	51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe

pid process

1660 51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe
1660 51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe

pid	process
1660	51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe
1660	51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe

description	pid	process	target process
PID 3560 wrote to memory of 1660	3560	51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe	51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe
PID 3560 wrote to memory of 1660	3560	51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe	51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe
PID 3560 wrote to memory of 1660	3560	51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe	51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe
PID 3560 wrote to memory of 1660	3560	51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe	51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe
PID 3560 wrote to memory of 1660	3560	51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe	51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe
PID 3560 wrote to memory of 1660	3560	51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe	51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3560

C:\Users\Admin\AppData\Local\Temp\51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\51dcc89ed1035a6c2fc57ada8dcb4dc2_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1660-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1660-14-0x0000000001090000-0x00000000013DA000-memory.dmp

Filesize
3.3MB

Download
memory/3560-6-0x0000000004D00000-0x0000000004D0A000-memory.dmp

Filesize
40KB

Download
memory/3560-3-0x0000000004C30000-0x0000000004CC2000-memory.dmp

Filesize
584KB

Download
memory/3560-5-0x00000000027F0000-0x00000000027FA000-memory.dmp

Filesize
40KB

Download
memory/3560-4-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/3560-0-0x0000000000230000-0x00000000002C4000-memory.dmp

Filesize
592KB

Download
memory/3560-7-0x00000000749C0000-0x0000000075170000-memory.dmp

Filesize
7.7MB

Download
memory/3560-8-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/3560-9-0x0000000006160000-0x00000000061FC000-memory.dmp

Filesize
624KB

Download
memory/3560-10-0x00000000062D0000-0x0000000006322000-memory.dmp

Filesize
328KB

Download
memory/3560-2-0x00000000052D0000-0x0000000005874000-memory.dmp

Filesize
5.6MB

Download
memory/3560-13-0x00000000749C0000-0x0000000075170000-memory.dmp

Filesize
7.7MB

Download
memory/3560-1-0x00000000749C0000-0x0000000075170000-memory.dmp

Filesize
7.7MB

Download