xloader | 19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/04/2024, 15:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe
Size 254KB
Sample240401-s5txaagf3x
SHA256 19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5
MD5 73fe142254abec3aeaef375f0564d40a
SHA1 8529d972dd89f69eb2dc2a3ba9207e67626de9b9
SHA512 848d4bc144f1f861823f08ab355184786f3832555236dffa2b5639e3ceb6c2578ff0da8c3870ba26f11f7609f0f4bbc50312db565c3a6adc6e8e3155915b328e
SSDEEP 6144:wBlL/ciQDQb+FraDHtBcDelxJu1cjf8Zx/saJJrBORxOZbmkZFPd:CeltxaPR8mL8Zx3JJrhRZb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xloader kqna loader rat

Malware Config

Extracted

Family

xloader

Version

Campaign

kqna

Decoy

achyutlifesciences.com
anthemmg.com
netkopat.com
generationgirlnaturals.com
novatel-network.com
craftstockco.com
thevishantiverse.art
elkerfly.com
haerotechs.com
candypalette.com
gregdokes.com
e-commerce.company
gratitudeland.com
companyintelcloud.com
publicyazilim.com
xc6811.com
aracsozluk.com
janesgalant.quest
fraserstephendop.com
ryan.rentals
wyse-solutions.com
reddishslouqb.xyz
rukygua.xyz
unlimitedrehab.com
fundafes.com
goodoffice.online
guserq.com
tigerstarmatka.com
ganleychevybuyscars.com
murrayforcongress.com
artistandfund.com
integritynotarial.com
cantomarbait.com
alifdanismanlik.com
meggisiegert.com
high-clicks3.com
xn--schwche-8wa.com
caffeiny.com
landsoftexasranchland.com
armmapp.com
cursosminharendaextra.com
globalmarineserv.com
lowestfars.com
finlayo.com
hautlescoeurscollection.com
cyclesforyou.com
bagwashs.com
medicaltrust-sd.com
passivemen.com
midatlanticbath.com
mchaskellproperties.com
facetofacewith.com
worldwidecorumuk.com
g632b.online
atozshoppingllc.com
jcswkj.net
czemi.com
minutemannetwork.net
hjku.xyz
uko7wuyj.xyz
amigasconesencia.com
hodgeandpartners.com
edfnu.com
corncobmeal.com
surfsolutions.info

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2032-9-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

pid	Process
2164	73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2164 set thread context of 2032	2164	73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2032	73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2032	2164	73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe	28
PID 2164 wrote to memory of 2032	2164	73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe	28
PID 2164 wrote to memory of 2032	2164	73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe	28
PID 2164 wrote to memory of 2032	2164	73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe	28
PID 2164 wrote to memory of 2032	2164	73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe	28
PID 2164 wrote to memory of 2032	2164	73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe	28
PID 2164 wrote to memory of 2032	2164	73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yhjjbtf.dll

Path \Users\Admin\AppData\Local\Temp\nsd29B0.tmp\yhjjbtf.dll
Size 33KB
SHA256 520857c7a5bfaeebf0f39504ae85d32b7e153774e93cb2be486f9a5d35b76d05
MD5 2109a0431e1e8fbce8007bc6dbdc8d2d
SHA1 f85d1cfa01ca893063af01510115bc279da84c2a
SHA512 a190901c467b65b18370aa3dbec9bb994294042fb78965b6baaf92a31fdc316912679a23f81f76a0d30f51c9c9ccbabcd58b0d420a1c6060508de1f0c0d320fb
SSDEEP 384:173rOmBpuRkCafMEILJBJn0GMZEhE7flHeKCB5qktAX6KiAEHpMUK6rbT7:171YiCeIdBMZT7f5eL5XfLzMUKcbX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2032-9-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2032-13-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Download

memory/2032-14-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Download

memory/2164-8-0x0000000010000000-0x000000001000B000-memory.dmp

Download

memory/2164-10-0x0000000010000000-0x000000001000B000-memory.dmp

Download