Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-04-2024 01:40

General

  • Target

    6429aa83e4bc083b4f0b3f44b0d7950f_JaffaCakes118.exe

  • Size

    463KB

  • MD5

    6429aa83e4bc083b4f0b3f44b0d7950f

  • SHA1

    0ead59881f054284f611accb61451ed1ffc818fc

  • SHA256

    96c57ae661562e958e01bb0b490c09a0a51bb367931620223174963de88bdfcb

  • SHA512

    186383701c591db2c011c8ae24920759c10880068dd217e32110ae54b9c7f0863b7fb04e893f601a234742deb5838a22820dc8835ba9198d66b7bb297d502f9b

  • SSDEEP

    6144:zMkhBsNolyfnZle9UX08PF85KQ4O1LkyUCZ2e12XZ0bp2Qo7lYB:oSBblyfnZlW+08+5KQpyy52nZ0vo7a

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6429aa83e4bc083b4f0b3f44b0d7950f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6429aa83e4bc083b4f0b3f44b0d7950f_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4972
    • C:\Users\Admin\AppData\Local\Temp\6429aa83e4bc083b4f0b3f44b0d7950f_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\6429aa83e4bc083b4f0b3f44b0d7950f_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3508-12-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/3508-15-0x0000000001280000-0x00000000015CA000-memory.dmp

    Filesize

    3.3MB

  • memory/4972-6-0x00000000056C0000-0x00000000056CA000-memory.dmp

    Filesize

    40KB

  • memory/4972-3-0x0000000005800000-0x0000000005986000-memory.dmp

    Filesize

    1.5MB

  • memory/4972-4-0x0000000005710000-0x00000000057A2000-memory.dmp

    Filesize

    584KB

  • memory/4972-5-0x0000000005630000-0x0000000005640000-memory.dmp

    Filesize

    64KB

  • memory/4972-0-0x0000000074B20000-0x00000000752D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4972-7-0x0000000005BF0000-0x0000000005BFA000-memory.dmp

    Filesize

    40KB

  • memory/4972-8-0x0000000074B20000-0x00000000752D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4972-9-0x0000000005630000-0x0000000005640000-memory.dmp

    Filesize

    64KB

  • memory/4972-10-0x0000000006ED0000-0x0000000006F6C000-memory.dmp

    Filesize

    624KB

  • memory/4972-11-0x0000000006F70000-0x0000000006FC2000-memory.dmp

    Filesize

    328KB

  • memory/4972-2-0x0000000005C20000-0x00000000061C4000-memory.dmp

    Filesize

    5.6MB

  • memory/4972-14-0x0000000074B20000-0x00000000752D0000-memory.dmp

    Filesize

    7.7MB

  • memory/4972-1-0x0000000000C60000-0x0000000000CDA000-memory.dmp

    Filesize

    488KB