Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01-04-2024 02:43

General

  • Target

    65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe

  • Size

    401KB

  • MD5

    65742020a34915e204448afb33bd0e2e

  • SHA1

    c21c726683fe4469870de2696eec8b824cef965c

  • SHA256

    e25be2c8b81539da9105c5bb4243ed37a8ded3cd6a1d15e2afec79418ebcfe85

  • SHA512

    b95bdea2f744b15c9e27a55c8e3124af94b8d6f51aa08767b39ba47f323fd3c8bb25e5eb9bfd14e2c48d4d2870ff9aff2cdb2a46bf58eb5b880699243c22b982

  • SSDEEP

    6144:6NPTWnndzk2VJuoEESdgruWAXvP/s81Khr2bCn6qkxuKY:6ZWnnR7JuoEES6aWA/Ihqboz

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

yjqn

Decoy

ittybittybunnies.com

flordedesierto.com

cum.care

petshomespace.com

verputzarbeit.com

yuvajanmat.com

getlie.com

finanes.xyz

thelazyrando.com

domelite.design

yukinko-takasu.com

pontosmensal.com

maurlinoconstruction.com

getelectronow.com

newmexicocarwrecklawfirm.com

gunnbucks.com

ncsy30.xyz

opsem.info

authorisewallet.com

scchanghe.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2772
    • C:\Users\Admin\AppData\Local\Temp\65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2472-6-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2472-7-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2472-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2472-10-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2472-12-0x00000000008A0000-0x0000000000BA3000-memory.dmp

    Filesize

    3.0MB

  • memory/2772-0-0x0000000000F70000-0x0000000000FDA000-memory.dmp

    Filesize

    424KB

  • memory/2772-1-0x0000000074770000-0x0000000074E5E000-memory.dmp

    Filesize

    6.9MB

  • memory/2772-2-0x0000000004C80000-0x0000000004CC0000-memory.dmp

    Filesize

    256KB

  • memory/2772-3-0x00000000005E0000-0x00000000005EE000-memory.dmp

    Filesize

    56KB

  • memory/2772-4-0x0000000074770000-0x0000000074E5E000-memory.dmp

    Filesize

    6.9MB

  • memory/2772-5-0x0000000004710000-0x0000000004762000-memory.dmp

    Filesize

    328KB

  • memory/2772-11-0x0000000074770000-0x0000000074E5E000-memory.dmp

    Filesize

    6.9MB