Malware Analysis Report

2024-10-23 17:07

Sample ID 240401-s5txaagf3x
Target 73fe142254abec3aeaef375f0564d40a_JaffaCakes118
SHA256 19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5
Tags
xloader kqna loader rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5

Threat Level: Known bad

The file 73fe142254abec3aeaef375f0564d40a_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

xloader kqna loader rat

Xloader

Xloader payload

Loads dropped DLL

Suspicious use of SetThreadContext

Program crash

Unsigned PE

Enumerates physical storage devices

NSIS installer

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-01 15:42

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-04-01 15:42

Reported

2024-04-01 15:45

Platform

win7-20240221-en

Max time kernel

147s

Max time network

119s

Command Line

C:\Windows\Explorer.EXE

Signatures

Xloader

loader xloader

Xloader payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2940 set thread context of 2368 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2368 set thread context of 1212 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Explorer.EXE
PID 2368 set thread context of 1212 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\Explorer.EXE
PID 2600 set thread context of 1212 N/A C:\Windows\SysWOW64\help.exe C:\Windows\Explorer.EXE

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\help.exe N/A
N/A N/A C:\Windows\SysWOW64\help.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\help.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2876 wrote to memory of 2940 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2876 wrote to memory of 2940 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2876 wrote to memory of 2940 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2876 wrote to memory of 2940 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2876 wrote to memory of 2940 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2876 wrote to memory of 2940 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2876 wrote to memory of 2940 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2940 wrote to memory of 2368 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2940 wrote to memory of 2368 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2940 wrote to memory of 2368 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2940 wrote to memory of 2368 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2940 wrote to memory of 2368 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2940 wrote to memory of 2368 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2940 wrote to memory of 2368 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2940 wrote to memory of 2368 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2940 wrote to memory of 2368 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2940 wrote to memory of 2368 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1212 wrote to memory of 2600 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\help.exe
PID 1212 wrote to memory of 2600 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\help.exe
PID 1212 wrote to memory of 2600 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\help.exe
PID 1212 wrote to memory of 2600 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\help.exe
PID 2600 wrote to memory of 2664 N/A C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\cmd.exe
PID 2600 wrote to memory of 2664 N/A C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\cmd.exe
PID 2600 wrote to memory of 2664 N/A C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\cmd.exe
PID 2600 wrote to memory of 2664 N/A C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\yhjjbtf.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\yhjjbtf.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\yhjjbtf.dll,#1

C:\Windows\SysWOW64\help.exe

"C:\Windows\SysWOW64\help.exe"

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Windows\SysWOW64\rundll32.exe"

Network

N/A

Files

memory/2940-0-0x0000000010000000-0x000000001000B000-memory.dmp

memory/2368-1-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2368-3-0x00000000020E0000-0x00000000023E3000-memory.dmp

memory/2940-2-0x0000000010000000-0x000000001000B000-memory.dmp

memory/1212-6-0x0000000003A20000-0x0000000003B20000-memory.dmp

memory/1212-8-0x0000000006790000-0x0000000006903000-memory.dmp

memory/2368-7-0x0000000000270000-0x0000000000281000-memory.dmp

memory/2368-5-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2368-11-0x00000000002B0000-0x00000000002C1000-memory.dmp

memory/2368-10-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1212-12-0x0000000007410000-0x0000000007580000-memory.dmp

memory/2600-13-0x00000000007D0000-0x00000000007D6000-memory.dmp

memory/2600-14-0x00000000007D0000-0x00000000007D6000-memory.dmp

memory/2600-15-0x0000000000080000-0x00000000000A9000-memory.dmp

memory/2600-16-0x00000000007E0000-0x0000000000AE3000-memory.dmp

memory/2600-17-0x0000000000080000-0x00000000000A9000-memory.dmp

memory/2600-19-0x0000000000530000-0x00000000005C0000-memory.dmp

memory/1212-21-0x0000000007410000-0x0000000007580000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-04-01 15:42

Reported

2024-04-01 15:45

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\yhjjbtf.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2816 wrote to memory of 2448 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2816 wrote to memory of 2448 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2816 wrote to memory of 2448 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2448 wrote to memory of 4900 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2448 wrote to memory of 4900 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2448 wrote to memory of 4900 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2448 wrote to memory of 4900 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\yhjjbtf.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\yhjjbtf.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\yhjjbtf.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2448 -ip 2448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 740

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 41.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 40.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 89.16.208.104.in-addr.arpa udp

Files

memory/2448-0-0x0000000010000000-0x000000001000B000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-01 15:42

Reported

2024-04-01 15:45

Platform

win7-20240221-en

Max time kernel

118s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe"

Signatures

Xloader

loader xloader

Xloader payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2164 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe
PID 2164 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe
PID 2164 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe
PID 2164 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe
PID 2164 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe
PID 2164 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe
PID 2164 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\nsd29B0.tmp\yhjjbtf.dll

MD5 2109a0431e1e8fbce8007bc6dbdc8d2d
SHA1 f85d1cfa01ca893063af01510115bc279da84c2a
SHA256 520857c7a5bfaeebf0f39504ae85d32b7e153774e93cb2be486f9a5d35b76d05
SHA512 a190901c467b65b18370aa3dbec9bb994294042fb78965b6baaf92a31fdc316912679a23f81f76a0d30f51c9c9ccbabcd58b0d420a1c6060508de1f0c0d320fb

memory/2164-8-0x0000000010000000-0x000000001000B000-memory.dmp

memory/2032-9-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2164-10-0x0000000010000000-0x000000001000B000-memory.dmp

memory/2032-13-0x00000000008A0000-0x0000000000BA3000-memory.dmp

memory/2032-14-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-01 15:42

Reported

2024-04-01 15:45

Platform

win10v2004-20231215-en

Max time kernel

89s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\73fe142254abec3aeaef375f0564d40a_JaffaCakes118.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3736 -ip 3736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 1060

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 40.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsm4CB9.tmp\yhjjbtf.dll

MD5 2109a0431e1e8fbce8007bc6dbdc8d2d
SHA1 f85d1cfa01ca893063af01510115bc279da84c2a
SHA256 520857c7a5bfaeebf0f39504ae85d32b7e153774e93cb2be486f9a5d35b76d05
SHA512 a190901c467b65b18370aa3dbec9bb994294042fb78965b6baaf92a31fdc316912679a23f81f76a0d30f51c9c9ccbabcd58b0d420a1c6060508de1f0c0d320fb

memory/3736-8-0x0000000010000000-0x000000001000B000-memory.dmp