Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    01-04-2024 23:57

General

  • Target

    7ddf9139b29b7b35647dfa9e585023de_JaffaCakes118.exe

  • Size

    397KB

  • MD5

    7ddf9139b29b7b35647dfa9e585023de

  • SHA1

    ff9455ae69b531bf1864ece4ab90dd8186f1ae28

  • SHA256

    4e9cb6e83b7ea6e353bafe82262c6b1c1de8a5fb5517fa8bd8bd80b353ca472d

  • SHA512

    a4e66072f3bbb32e6f5594065eba358a05113c7e56b3e149c68dfd4905661489385af03e9a1d89d9c087a856a88c5ee699fc3c6f9a212962856988c89a81aad2

  • SSDEEP

    6144:agwqt/BtMSCT/xmu9DC1pZbpUhiGYcpskR+8O57P7/CpYQCbszjY:AqSSEUKDC15BGJekR+77lQ94

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

sw39

Decoy

ashwinpokharel.com

bzsxlaw.com

know-christ.com

findevinsurance.com

greenlink-engineering.com

poseidonvips.com

thebrandstudiointernational.com

airkrol.com

callofdutytool.xyz

anthologyofenglishpoems.info

dandftrading.com

cjrotulacion.com

tiroalpalodigital.com

axeologements.com

nchh29.xyz

karedxb.com

9158cs.xyz

christialana.com

francegravures.com

snclgroupsource.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ddf9139b29b7b35647dfa9e585023de_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7ddf9139b29b7b35647dfa9e585023de_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Users\Admin\AppData\Local\Temp\7ddf9139b29b7b35647dfa9e585023de_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\7ddf9139b29b7b35647dfa9e585023de_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2060-1-0x00000000000F0000-0x0000000000130000-memory.dmp

    Filesize

    256KB

  • memory/2060-0-0x00000000741A0000-0x000000007474B000-memory.dmp

    Filesize

    5.7MB

  • memory/2060-2-0x00000000741A0000-0x000000007474B000-memory.dmp

    Filesize

    5.7MB

  • memory/2060-3-0x00000000741A0000-0x000000007474B000-memory.dmp

    Filesize

    5.7MB

  • memory/2060-4-0x00000000000F0000-0x0000000000130000-memory.dmp

    Filesize

    256KB

  • memory/2060-5-0x00000000000F0000-0x0000000000130000-memory.dmp

    Filesize

    256KB

  • memory/2060-11-0x00000000741A0000-0x000000007474B000-memory.dmp

    Filesize

    5.7MB

  • memory/2272-6-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2272-7-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2272-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2272-10-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2272-12-0x0000000000890000-0x0000000000B93000-memory.dmp

    Filesize

    3.0MB