Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-04-2024 19:37

General

  • Target

    7890ee8b506470d111dffe7df8b06093_JaffaCakes118.exe

  • Size

    352KB

  • MD5

    7890ee8b506470d111dffe7df8b06093

  • SHA1

    83a5147df1ffb90c75a5a8686fec80b8b22cbe9c

  • SHA256

    5270bc9905eafb0b4174ba7ab447db19d7f7dc3adbc5b6a2a747fda70a63849e

  • SHA512

    f342f11a762555939b242a0416e6ec7c0a3e588a14325e152309530ec9354fc08b1b6da5d5027d7df03411b526071d25e8a56862f6f0ca44adaba3645923b07e

  • SSDEEP

    6144:A0zAuMkhBm0/dqaE4jxmG1J3OsKPyGBNzpZeQkX67P0FRUrJU6fnLFzdVl8R:y9SBnq9C1bOsdGTKQb7PcRYXfLToR

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

snec

Decoy

sacramentoscoop.com

auroraeqp.com

ontactfactory.com

abenakigroup.com

xander-tech.com

cocaineislegal.com

carbondouze.com

louisvilleestatelawyer.com

sundaytejero.quest

arti-faqs.com

thisandthat.store

biodyne-el-salvador.com

18504seheritageoakslane.com

mfialias.xyz

whitestoneclo.com

6288117.com

oficiosuy.com

autogift.xyz

wallbabyshell.com

chaletlabaie.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7890ee8b506470d111dffe7df8b06093_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7890ee8b506470d111dffe7df8b06093_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3488
    • C:\Users\Admin\AppData\Local\Temp\7890ee8b506470d111dffe7df8b06093_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\7890ee8b506470d111dffe7df8b06093_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1440-11-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1440-15-0x0000000001860000-0x0000000001BAA000-memory.dmp

    Filesize

    3.3MB

  • memory/1440-14-0x0000000001860000-0x0000000001BAA000-memory.dmp

    Filesize

    3.3MB

  • memory/3488-6-0x0000000005200000-0x000000000520A000-memory.dmp

    Filesize

    40KB

  • memory/3488-4-0x0000000004F40000-0x0000000004F50000-memory.dmp

    Filesize

    64KB

  • memory/3488-5-0x0000000004F90000-0x0000000004F9A000-memory.dmp

    Filesize

    40KB

  • memory/3488-0-0x00000000006B0000-0x000000000070E000-memory.dmp

    Filesize

    376KB

  • memory/3488-7-0x0000000075120000-0x00000000758D0000-memory.dmp

    Filesize

    7.7MB

  • memory/3488-8-0x0000000004F40000-0x0000000004F50000-memory.dmp

    Filesize

    64KB

  • memory/3488-9-0x0000000006610000-0x00000000066AC000-memory.dmp

    Filesize

    624KB

  • memory/3488-10-0x00000000066B0000-0x0000000006702000-memory.dmp

    Filesize

    328KB

  • memory/3488-3-0x0000000004FF0000-0x0000000005082000-memory.dmp

    Filesize

    584KB

  • memory/3488-13-0x0000000075120000-0x00000000758D0000-memory.dmp

    Filesize

    7.7MB

  • memory/3488-2-0x00000000055A0000-0x0000000005B44000-memory.dmp

    Filesize

    5.6MB

  • memory/3488-1-0x0000000075120000-0x00000000758D0000-memory.dmp

    Filesize

    7.7MB