xloader | e4a4e1f73cbbd5667b5264b48bc7429ea638532d08e78d53b86b86c0fa5b291b

General

Target

87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
Size

373KB
MD5

87cd2ddf31c62ed3219d2c559d4a9cb6
SHA1

778feade270eae6041a76bb962c42b5b85d9199d
SHA256

e4a4e1f73cbbd5667b5264b48bc7429ea638532d08e78d53b86b86c0fa5b291b
SHA512

92a946f2f060eea48533efd71bde81b14ec1a6d969a64b87eea37489625aba1f8959cab50077fb8f99d8d6285766675343b6c2b130b8a1831b2beb1828ff1df0
SSDEEP

6144:bjaohYpyMkhBTJKLDW5dhpTTsdXJWqAIdYrSLdal3tUC80o+cCBtQsIAUVru:PaoYSBTJnhpUdZbverSxtC8Tc6uIi

Score

10^/10

xloader ef6c loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4700-11-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe

description	pid	process	target process
PID 1572 set thread context of 4700	1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe

pid	process
1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
4700	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
4700	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1572 87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe

description	pid	process	target process
PID 1572 wrote to memory of 2912	1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
PID 1572 wrote to memory of 2912	1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
PID 1572 wrote to memory of 2912	1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
PID 1572 wrote to memory of 4628	1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
PID 1572 wrote to memory of 4628	1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
PID 1572 wrote to memory of 4628	1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
PID 1572 wrote to memory of 4700	1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
PID 1572 wrote to memory of 4700	1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
PID 1572 wrote to memory of 4700	1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
PID 1572 wrote to memory of 4700	1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
PID 1572 wrote to memory of 4700	1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
PID 1572 wrote to memory of 4700	1572	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe	87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572

C:\Users\Admin\AppData\Local\Temp\87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe"
2⤵
PID:2912

C:\Users\Admin\AppData\Local\Temp\87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe"
2⤵
PID:4628

C:\Users\Admin\AppData\Local\Temp\87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\87cd2ddf31c62ed3219d2c559d4a9cb6_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-6-0x0000000005100000-0x000000000510A000-memory.dmp

Filesize
40KB

Download
memory/1572-8-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/1572-2-0x0000000005110000-0x00000000056B4000-memory.dmp

Filesize
5.6MB

Download
memory/1572-3-0x0000000004C00000-0x0000000004C92000-memory.dmp

Filesize
584KB

Download
memory/1572-4-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Filesize
64KB

Download
memory/1572-5-0x0000000004BB0000-0x0000000004BBA000-memory.dmp

Filesize
40KB

Download
memory/1572-1-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/1572-7-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/1572-0-0x0000000000170000-0x00000000001D4000-memory.dmp

Filesize
400KB

Download
memory/1572-9-0x0000000006210000-0x00000000062AC000-memory.dmp

Filesize
624KB

Download
memory/1572-10-0x00000000062B0000-0x0000000006302000-memory.dmp

Filesize
328KB

Download
memory/1572-13-0x0000000075130000-0x00000000758E0000-memory.dmp

Filesize
7.7MB

Download
memory/4700-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4700-14-0x0000000001890000-0x0000000001BDA000-memory.dmp

Filesize
3.3MB

Download
memory/4700-15-0x0000000001890000-0x0000000001BDA000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads