Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01-04-2024 19:37

General

  • Target

    7890ee8b506470d111dffe7df8b06093_JaffaCakes118.exe

  • Size

    352KB

  • MD5

    7890ee8b506470d111dffe7df8b06093

  • SHA1

    83a5147df1ffb90c75a5a8686fec80b8b22cbe9c

  • SHA256

    5270bc9905eafb0b4174ba7ab447db19d7f7dc3adbc5b6a2a747fda70a63849e

  • SHA512

    f342f11a762555939b242a0416e6ec7c0a3e588a14325e152309530ec9354fc08b1b6da5d5027d7df03411b526071d25e8a56862f6f0ca44adaba3645923b07e

  • SSDEEP

    6144:A0zAuMkhBm0/dqaE4jxmG1J3OsKPyGBNzpZeQkX67P0FRUrJU6fnLFzdVl8R:y9SBnq9C1bOsdGTKQb7PcRYXfLToR

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

snec

Decoy

sacramentoscoop.com

auroraeqp.com

ontactfactory.com

abenakigroup.com

xander-tech.com

cocaineislegal.com

carbondouze.com

louisvilleestatelawyer.com

sundaytejero.quest

arti-faqs.com

thisandthat.store

biodyne-el-salvador.com

18504seheritageoakslane.com

mfialias.xyz

whitestoneclo.com

6288117.com

oficiosuy.com

autogift.xyz

wallbabyshell.com

chaletlabaie.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7890ee8b506470d111dffe7df8b06093_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7890ee8b506470d111dffe7df8b06093_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Users\Admin\AppData\Local\Temp\7890ee8b506470d111dffe7df8b06093_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\7890ee8b506470d111dffe7df8b06093_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/928-7-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/928-13-0x0000000000D00000-0x0000000001003000-memory.dmp

    Filesize

    3.0MB

  • memory/928-11-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/928-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/928-8-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1976-3-0x0000000000880000-0x000000000088A000-memory.dmp

    Filesize

    40KB

  • memory/1976-6-0x0000000004C60000-0x0000000004CB2000-memory.dmp

    Filesize

    328KB

  • memory/1976-5-0x0000000004CD0000-0x0000000004D10000-memory.dmp

    Filesize

    256KB

  • memory/1976-4-0x0000000074BA0000-0x000000007528E000-memory.dmp

    Filesize

    6.9MB

  • memory/1976-0-0x0000000000CA0000-0x0000000000CFE000-memory.dmp

    Filesize

    376KB

  • memory/1976-2-0x0000000004CD0000-0x0000000004D10000-memory.dmp

    Filesize

    256KB

  • memory/1976-12-0x0000000074BA0000-0x000000007528E000-memory.dmp

    Filesize

    6.9MB

  • memory/1976-1-0x0000000074BA0000-0x000000007528E000-memory.dmp

    Filesize

    6.9MB