Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-04-2024 02:43

General

  • Target

    65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe

  • Size

    401KB

  • MD5

    65742020a34915e204448afb33bd0e2e

  • SHA1

    c21c726683fe4469870de2696eec8b824cef965c

  • SHA256

    e25be2c8b81539da9105c5bb4243ed37a8ded3cd6a1d15e2afec79418ebcfe85

  • SHA512

    b95bdea2f744b15c9e27a55c8e3124af94b8d6f51aa08767b39ba47f323fd3c8bb25e5eb9bfd14e2c48d4d2870ff9aff2cdb2a46bf58eb5b880699243c22b982

  • SSDEEP

    6144:6NPTWnndzk2VJuoEESdgruWAXvP/s81Khr2bCn6qkxuKY:6ZWnnR7JuoEES6aWA/Ihqboz

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

yjqn

Decoy

ittybittybunnies.com

flordedesierto.com

cum.care

petshomespace.com

verputzarbeit.com

yuvajanmat.com

getlie.com

finanes.xyz

thelazyrando.com

domelite.design

yukinko-takasu.com

pontosmensal.com

maurlinoconstruction.com

getelectronow.com

newmexicocarwrecklawfirm.com

gunnbucks.com

ncsy30.xyz

opsem.info

authorisewallet.com

scchanghe.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Users\Admin\AppData\Local\Temp\65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/208-11-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/208-15-0x00000000017F0000-0x0000000001B3A000-memory.dmp

    Filesize

    3.3MB

  • memory/208-14-0x00000000017F0000-0x0000000001B3A000-memory.dmp

    Filesize

    3.3MB

  • memory/1048-6-0x0000000006190000-0x000000000622C000-memory.dmp

    Filesize

    624KB

  • memory/1048-4-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

    Filesize

    64KB

  • memory/1048-5-0x0000000004A50000-0x0000000004A5A000-memory.dmp

    Filesize

    40KB

  • memory/1048-1-0x0000000074E80000-0x0000000075630000-memory.dmp

    Filesize

    7.7MB

  • memory/1048-7-0x0000000004FA0000-0x0000000004FAE000-memory.dmp

    Filesize

    56KB

  • memory/1048-8-0x0000000074E80000-0x0000000075630000-memory.dmp

    Filesize

    7.7MB

  • memory/1048-9-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

    Filesize

    64KB

  • memory/1048-10-0x0000000006100000-0x0000000006152000-memory.dmp

    Filesize

    328KB

  • memory/1048-3-0x0000000004AC0000-0x0000000004B52000-memory.dmp

    Filesize

    584KB

  • memory/1048-13-0x0000000074E80000-0x0000000075630000-memory.dmp

    Filesize

    7.7MB

  • memory/1048-2-0x0000000004FD0000-0x0000000005574000-memory.dmp

    Filesize

    5.6MB

  • memory/1048-0-0x0000000000020000-0x000000000008A000-memory.dmp

    Filesize

    424KB