Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
01/04/2024, 02:43
General
- Target 65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe
- Size 401KB
- Sample240401-c7zbsabe4v
- SHA256 e25be2c8b81539da9105c5bb4243ed37a8ded3cd6a1d15e2afec79418ebcfe85
Malware Config
Extracted
-
xloader
-
2.5
-
yjqn
-
ittybittybunnies.com
-
flordedesierto.com
-
cum.care
-
petshomespace.com
-
verputzarbeit.com
-
yuvajanmat.com
-
getlie.com
-
finanes.xyz
-
thelazyrando.com
-
domelite.design
-
yukinko-takasu.com
-
pontosmensal.com
-
maurlinoconstruction.com
-
getelectronow.com
-
newmexicocarwrecklawfirm.com
-
gunnbucks.com
-
ncsy30.xyz
-
opsem.info
-
authorisewallet.com
-
scchanghe.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\65742020a34915e204448afb33bd0e2e_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/208-11-0x0000000000400000-0x0000000000429000-memory.dmp
memory/208-15-0x00000000017F0000-0x0000000001B3A000-memory.dmp
memory/208-14-0x00000000017F0000-0x0000000001B3A000-memory.dmp
memory/1048-6-0x0000000006190000-0x000000000622C000-memory.dmp
memory/1048-4-0x0000000004AB0000-0x0000000004AC0000-memory.dmp
memory/1048-5-0x0000000004A50000-0x0000000004A5A000-memory.dmp
memory/1048-1-0x0000000074E80000-0x0000000075630000-memory.dmp
memory/1048-7-0x0000000004FA0000-0x0000000004FAE000-memory.dmp
memory/1048-8-0x0000000074E80000-0x0000000075630000-memory.dmp
memory/1048-9-0x0000000004AB0000-0x0000000004AC0000-memory.dmp
memory/1048-10-0x0000000006100000-0x0000000006152000-memory.dmp
memory/1048-3-0x0000000004AC0000-0x0000000004B52000-memory.dmp
memory/1048-13-0x0000000074E80000-0x0000000075630000-memory.dmp
memory/1048-2-0x0000000004FD0000-0x0000000005574000-memory.dmp
memory/1048-0-0x0000000000020000-0x000000000008A000-memory.dmp