Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-04-2024 02:43
Static task
static1
Behavioral task
behavioral1
Sample
65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe
-
Size
401KB
-
MD5
65742020a34915e204448afb33bd0e2e
-
SHA1
c21c726683fe4469870de2696eec8b824cef965c
-
SHA256
e25be2c8b81539da9105c5bb4243ed37a8ded3cd6a1d15e2afec79418ebcfe85
-
SHA512
b95bdea2f744b15c9e27a55c8e3124af94b8d6f51aa08767b39ba47f323fd3c8bb25e5eb9bfd14e2c48d4d2870ff9aff2cdb2a46bf58eb5b880699243c22b982
-
SSDEEP
6144:6NPTWnndzk2VJuoEESdgruWAXvP/s81Khr2bCn6qkxuKY:6ZWnnR7JuoEES6aWA/Ihqboz
Malware Config
Extracted
xloader
2.5
yjqn
ittybittybunnies.com
flordedesierto.com
cum.care
petshomespace.com
verputzarbeit.com
yuvajanmat.com
getlie.com
finanes.xyz
thelazyrando.com
domelite.design
yukinko-takasu.com
pontosmensal.com
maurlinoconstruction.com
getelectronow.com
newmexicocarwrecklawfirm.com
gunnbucks.com
ncsy30.xyz
opsem.info
authorisewallet.com
scchanghe.com
dpisa.info
z5r9t.online
paisleiskreations.com
arabatalmustahlik.com
summahred.com
moodplans.com
theglobalonlineacademy.com
dutchdollhouse.com
strolleyluggage.online
qimai51.com
2day-sweeps.info
skyguardens.com
lilijewls.com
if.services
teneses.com
bwteeco.com
walletsupportsnow.com
mk696.com
suddennnnnnnnnnnn48.xyz
alphadogsocial.com
michitorres.com
trybestchoice.com
axelar.academy
mountlaketerraceapartment.com
webmakers.xyz
domaineregnard.com
snail-sky.com
jengibre.xyz
sichuanyitai.com
otqrfw.com
rcdating.com
youyushops.com
fltraffic.net
68065123.com
standingoncommonground.net
eqzaec.com
yujieqin.com
aquitemtijolo.com
worldhealthplanet.com
galmbacher-legal.com
acumen-international.com
predictablecomfort365.com
atesex.com
roboruben.com
wavekiss.com
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/208-11-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
65742020a34915e204448afb33bd0e2e_JaffaCakes118.exedescription pid process target process PID 1048 set thread context of 208 1048 65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe 65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
65742020a34915e204448afb33bd0e2e_JaffaCakes118.exepid process 208 65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe 208 65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
65742020a34915e204448afb33bd0e2e_JaffaCakes118.exedescription pid process target process PID 1048 wrote to memory of 208 1048 65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe 65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe PID 1048 wrote to memory of 208 1048 65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe 65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe PID 1048 wrote to memory of 208 1048 65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe 65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe PID 1048 wrote to memory of 208 1048 65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe 65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe PID 1048 wrote to memory of 208 1048 65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe 65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe PID 1048 wrote to memory of 208 1048 65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe 65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:208