xloader | e4a4e1f73cbbd5667b5264b48bc7429ea638532d08e78d53b86b86c0fa5b291b

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-04-2024 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
Size

373KB
MD5

87cd2ddf31c62ed3219d2c559d4a9cb6
SHA1

778feade270eae6041a76bb962c42b5b85d9199d
SHA256

e4a4e1f73cbbd5667b5264b48bc7429ea638532d08e78d53b86b86c0fa5b291b
SHA512

92a946f2f060eea48533efd71bde81b14ec1a6d969a64b87eea37489625aba1f8959cab50077fb8f99d8d6285766675343b6c2b130b8a1831b2beb1828ff1df0
SSDEEP

6144:bjaohYpyMkhBTJKLDW5dhpTTsdXJWqAIdYrSLdal3tUC80o+cCBtQsIAUVru:PaoYSBTJnhpUdZbverSxtC8Tc6uIi

Score

10^/10

xloader ef6c loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2472-13-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe

description	pid	process	target process
PID 2168 set thread context of 2472	2168	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe

pid process

2472 87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe

pid	process
2472	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe

description	pid	process	target process
PID 2168 wrote to memory of 2472	2168	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
PID 2168 wrote to memory of 2472	2168	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
PID 2168 wrote to memory of 2472	2168	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
PID 2168 wrote to memory of 2472	2168	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
PID 2168 wrote to memory of 2472	2168	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
PID 2168 wrote to memory of 2472	2168	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
PID 2168 wrote to memory of 2472	2168	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2168

C:\Users\Admin\AppData\Local\Temp\87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2472

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-6-0x0000000004740000-0x0000000004792000-memory.dmp

Filesize
328KB

Download
memory/2168-1-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2168-2-0x00000000047A0000-0x00000000047E0000-memory.dmp

Filesize
256KB

Download
memory/2168-3-0x00000000005A0000-0x00000000005AA000-memory.dmp

Filesize
40KB

Download
memory/2168-4-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2168-5-0x00000000047A0000-0x00000000047E0000-memory.dmp

Filesize
256KB

Download
memory/2168-0-0x0000000000CE0000-0x0000000000D44000-memory.dmp

Filesize
400KB

Download
memory/2168-14-0x0000000074DC0000-0x00000000754AE000-memory.dmp

Filesize
6.9MB

Download
memory/2472-7-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2472-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2472-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2472-13-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2472-15-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads