Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    01-04-2024 22:38

General

  • Target

    7c48d5a7ae49ca4649503c6b41699d50_JaffaCakes118.exe

  • Size

    389KB

  • MD5

    7c48d5a7ae49ca4649503c6b41699d50

  • SHA1

    a69ed59d393ee4929668a83323853ea752330c94

  • SHA256

    6d9669eccc50a3331c3138b4649edfe5e5096693ab4647696d5e1075c95b8fbf

  • SHA512

    a9a5dba7d5e21394c32d7d95b15b79ff3131121f478d469cdebbf06b49219e6e5fd230698f3bca550a5175a88a7f1f9f634644396d4ebcd0d13580a9dada3417

  • SSDEEP

    12288:TK1Gta0NmUDWVqLbHLJElYIx+ZCW6OP62IIs:Tr7NkVqPHLJECGWM2IIs

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

g53s

Decoy

kosnac.com

tujaso.com

handmadealtrimenti.com

txclaimsguy.com

newonedrivedocc.com

11t.xyz

shawnliang.tech

worldigger.com

lesgitar.online

winlanddepot.xyz

mofangxx.store

8ls-world.com

localrelics.com

piccadeliquickup.com

rhinogroup.online

hxrhorend.quest

avtfitness.com

oakabbey.net

presox.com

bluegreendi.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c48d5a7ae49ca4649503c6b41699d50_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7c48d5a7ae49ca4649503c6b41699d50_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Users\Admin\AppData\Local\Temp\7c48d5a7ae49ca4649503c6b41699d50_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\7c48d5a7ae49ca4649503c6b41699d50_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2168-7-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2168-13-0x0000000000830000-0x0000000000B33000-memory.dmp

    Filesize

    3.0MB

  • memory/2168-11-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2168-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2168-8-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/3028-3-0x00000000004A0000-0x00000000004AE000-memory.dmp

    Filesize

    56KB

  • memory/3028-6-0x0000000004FD0000-0x0000000005022000-memory.dmp

    Filesize

    328KB

  • memory/3028-5-0x0000000004E90000-0x0000000004ED0000-memory.dmp

    Filesize

    256KB

  • memory/3028-4-0x00000000744C0000-0x0000000074BAE000-memory.dmp

    Filesize

    6.9MB

  • memory/3028-0-0x0000000001130000-0x0000000001198000-memory.dmp

    Filesize

    416KB

  • memory/3028-2-0x0000000004E90000-0x0000000004ED0000-memory.dmp

    Filesize

    256KB

  • memory/3028-12-0x00000000744C0000-0x0000000074BAE000-memory.dmp

    Filesize

    6.9MB

  • memory/3028-1-0x00000000744C0000-0x0000000074BAE000-memory.dmp

    Filesize

    6.9MB