Analysis
- max time kernel
147s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240319-en - resource tags
- submitted
01/04/2024, 05:54
General
- Target 699589bd45b3cfbe2800dd137a56619d_JaffaCakes118.exe
- Size 653KB
- Sample240401-gl741sfa9w
- SHA256 0ce4e2f71989e9a0a4aef640b12237135e2be4b037f9cf533ca7925224e9daa8
Malware Config
Extracted
-
xloader
-
2.5
-
mqi9
-
spectehnika-rb.com
-
daleproaudio.xyz
-
cpw887.com
-
gosbs-b01.com
-
clarkmanagementhawaii.com
-
taobaoi68.xyz
-
hoppedchardonnay.com
-
extremesavings.net
-
newbiepanda.com
-
arul-jegadish.com
-
kellibrat.com
-
avto-mercury.info
-
percussionportal.com
-
colorfulworldpublishing.com
-
notvaccinatedjobs.com
-
cattavida.com
-
pioniersa.com
-
yanduy.com
-
mzjing.com
-
piedmontpines.school
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\699589bd45b3cfbe2800dd137a56619d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\699589bd45b3cfbe2800dd137a56619d_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\699589bd45b3cfbe2800dd137a56619d_JaffaCakes118.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=712 --field-trial-handle=2268,i,4334050275411101233,11484630688883830558,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1580-8-0x0000000003330000-0x0000000003344000-memory.dmp
memory/1580-9-0x0000000074DF0000-0x00000000755A0000-memory.dmp
memory/1580-2-0x0000000005960000-0x00000000059FC000-memory.dmp
memory/1580-3-0x0000000005FB0000-0x0000000006554000-memory.dmp
memory/1580-4-0x0000000005AA0000-0x0000000005B32000-memory.dmp
memory/1580-5-0x0000000005940000-0x0000000005950000-memory.dmp
memory/1580-0-0x0000000000F30000-0x0000000000FDA000-memory.dmp
memory/1580-6-0x0000000005A40000-0x0000000005A4A000-memory.dmp
memory/1580-1-0x0000000074DF0000-0x00000000755A0000-memory.dmp
memory/1580-7-0x0000000005CD0000-0x0000000005D26000-memory.dmp
memory/1580-10-0x0000000005940000-0x0000000005950000-memory.dmp
memory/1580-11-0x0000000008760000-0x00000000087E2000-memory.dmp
memory/1580-12-0x000000000A910000-0x000000000A940000-memory.dmp
memory/1580-15-0x0000000074DF0000-0x00000000755A0000-memory.dmp
memory/4920-13-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4920-16-0x0000000001310000-0x000000000165A000-memory.dmp