Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 05:44
Static task
static1
Behavioral task
behavioral1
Sample
853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe
-
Size
481KB
-
MD5
853ef1dd6f3f39f1cb4730d5b4c92788
-
SHA1
d21e15ce6e8792f4f643601d1ad1173c87e882be
-
SHA256
03bef4cce37594b14884c28536f8247413f51286388528e6f0c6c6de27106cde
-
SHA512
d5f17a2c0d920a843e21a60598080b801acbe966226debd25016651192853c38ca8091a620d328d0c48de31139136a2327cb1fbb9f12821c079e834120b4a50e
-
SSDEEP
12288:M1nTXR0DY3UKZ9nBkOCOaw30ChpYzVEfFn+rzh1TqvX9slNVH9f3gWo84y626L/T:cnzjqo3j
Malware Config
Extracted
xloader
2.5
g2pg
xzq151516.net
ijournaltnpasumo5.xyz
hoclconsultantions.com
orcasdefense.com
businessvalues.online
popkidscollection.com
xn--sargelinemlak-59b.com
filmschool.asia
yalding.com
az-property-solutions.com
dnahotcars.com
cunnters.com
rkmuscles.com
artshowespelhos.com
tagfat.online
kenganashura.net
ayelenpsicologa.com
hotelmipetate.com
etuwrestling.com
von-wehner.com
stronghal.com
codigocentro.com
coralshelf.com
ff4c7x0gm.xyz
fbsp3.xyz
climatecheckin.com
pressonnailsie.com
xenosapiens.online
maslsk.com
hotelapril.net
john-way.com
mautsard.com
alishamerritt.com
iphone13promax.review
attaqwa.store
o594666.com
vantio.net
wenhaitingtao.com
civilherald.com
angelaporterward.com
snulya.com
fanzerkalo.online
flexghost.xyz
contactcenter3.email
zaproszenie-banku.xyz
ouridoo.com
riverhills.biz
ys2m.com
jdm-s.store
bucksplit.com
scissorsmovie.store
makeup-first.xyz
lovarebtoyof5.xyz
hackensacklegal.com
bgsp3.xyz
louisebeckinsale.net
drachmacoins.com
photographersblueprint.com
wastronature.com
osunconcepts.com
rednacionaldejueces.net
homeofficelist.com
mingshan888.com
etiketlabel-reserveren.online
boitecfermenti.com
Signatures
-
Xloader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2632-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exedescription pid process target process PID 1912 set thread context of 2632 1912 853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe 853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exepid process 2632 853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exedescription pid process target process PID 1912 wrote to memory of 2632 1912 853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe 853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe PID 1912 wrote to memory of 2632 1912 853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe 853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe PID 1912 wrote to memory of 2632 1912 853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe 853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe PID 1912 wrote to memory of 2632 1912 853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe 853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe PID 1912 wrote to memory of 2632 1912 853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe 853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe PID 1912 wrote to memory of 2632 1912 853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe 853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe PID 1912 wrote to memory of 2632 1912 853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe 853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\853ef1dd6f3f39f1cb4730d5b4c92788_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2632