Analysis
- max time kernel
143s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
01/04/2024, 22:38
General
- Target 7c48d5a7ae49ca4649503c6b41699d50_JaffaCakes118.exe
- Size 389KB
- Sample240401-2kmf5shb2t
- SHA256 6d9669eccc50a3331c3138b4649edfe5e5096693ab4647696d5e1075c95b8fbf
Malware Config
Extracted
-
xloader
-
2.5
-
g53s
-
kosnac.com
-
tujaso.com
-
handmadealtrimenti.com
-
txclaimsguy.com
-
newonedrivedocc.com
-
11t.xyz
-
shawnliang.tech
-
worldigger.com
-
lesgitar.online
-
winlanddepot.xyz
-
mofangxx.store
-
8ls-world.com
-
localrelics.com
-
piccadeliquickup.com
-
rhinogroup.online
-
hxrhorend.quest
-
avtfitness.com
-
oakabbey.net
-
presox.com
-
bluegreendi.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c48d5a7ae49ca4649503c6b41699d50_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7c48d5a7ae49ca4649503c6b41699d50_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7c48d5a7ae49ca4649503c6b41699d50_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7c48d5a7ae49ca4649503c6b41699d50_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4708-6-0x0000000006770000-0x000000000680C000-memory.dmp
memory/4708-10-0x000000000A3A0000-0x000000000A3F2000-memory.dmp
memory/4708-2-0x0000000005710000-0x0000000005CB4000-memory.dmp
memory/4708-3-0x0000000005200000-0x0000000005292000-memory.dmp
memory/4708-4-0x0000000005390000-0x00000000053A0000-memory.dmp
memory/4708-5-0x00000000052B0000-0x00000000052BA000-memory.dmp
memory/4708-8-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/4708-14-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/4708-1-0x00000000007E0000-0x0000000000848000-memory.dmp
memory/4708-9-0x0000000005390000-0x00000000053A0000-memory.dmp
memory/4708-0-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/4708-7-0x00000000065E0000-0x00000000065EE000-memory.dmp
memory/4872-11-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4872-13-0x0000000001910000-0x0000000001C5A000-memory.dmp