Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-04-2024 21:33

General

  • Target

    97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe

  • Size

    457KB

  • MD5

    97bc9fc82cdd0607f0bd1e83622b80ba

  • SHA1

    b066758974a6efef88abd3e772171a4bab89d1e8

  • SHA256

    7a12f38cc2bd503f9667620f86315281e8319f9f2dca72aa19eb19ff6f3629a6

  • SHA512

    b81cf826017f05a7a1d4fa42e61a0da20cbb5b7f02a90881bcdc01f24b64b1880f7078328082d29d9b3fbd957de8fff164f23b0f564fb7f41128841ed7b9ccc2

  • SSDEEP

    6144:FBlL/H4sYGXW+W9PTqKkq0KjtS8AE5gktrPnO1+RJRUw167GVRiG62:TKGXW+WJTe8xSAgktTOoRJ+wCSkG5

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b65i

Decoy

leofighters.com

smartat2.xyz

encontrevariedades.com

jimwilliamstutoring.com

kanpaiecuador.com

accura-inv.com

xtzgjxzz.com

scentstrategies.com

high-clicks2.com

hadishgebray.com

woodlawnbailbonds.com

dmsolutionsco.com

rdvulm21.com

beachyweens.com

ishirmansingh.com

rimmasbracelets.com

kellibrat.com

roselmasm.com

datkamoney.info

fermers.club

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:924
    • C:\Users\Admin\AppData\Local\Temp\97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\97bc9fc82cdd0607f0bd1e83622b80ba_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsj76A8.tmp\nrxdd.dll

    Filesize

    42KB

    MD5

    5a5c717c752014c115f8cd5269d09230

    SHA1

    9e98b8f7fc33c2a635b7fafae816e70a991db637

    SHA256

    bbd19853959f6a7e000b9bd1880416753f9129294efc7b5eba835891b4034459

    SHA512

    350f82e6eda8687197d911cddd6d84f734e77f63d538062c49298076db297907643f8771544000d4697d5c3f3995b488ef787a5ba132c89f6b2fba6b5be9a361

  • memory/924-8-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/924-10-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/2352-9-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2352-11-0x0000000000A10000-0x0000000000D5A000-memory.dmp

    Filesize

    3.3MB