Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02-04-2024 16:56

General

  • Target

    920e626bea0e4949daea75e2a332f481_JaffaCakes118.exe

  • Size

    559KB

  • MD5

    920e626bea0e4949daea75e2a332f481

  • SHA1

    2d82ef86265c1e490744b53de82dc9be163192a7

  • SHA256

    08040f352684d740d9fa767c3315fb1636394dec01f35abe84ad7116cd735fb4

  • SHA512

    035ad5fe790eff621e5f1b1ded413fec6a2b0af1cbf71c5db33a026ca2a74b5ff3a2e1a05319927d603c64fb7d7403081e5961d3bafd69b56facff1ebb3c3f01

  • SSDEEP

    12288:EESo0nmHTrkIv/+p8OD4WnmOQVZMXfK4La/oc13:EESZmHTQIvmp/FnmOGY7LWJ

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

hu8c

Decoy

aliceso.photography

exploitslozdz.xyz

chokefirmbeauty.com

sapix-usa.com

perfectioncheergym.com

igfo.xyz

xc6686.com

aclproreubensnyder.com

xn--bin-2k4mp34c09iwiz.com

daumien.com

atlanticuniombank.com

ookawa.club

cherrywoodranchvacationhome.com

s6gfec.com

ryo-toolset.store

talltailfishing.com

creativelyaustin.com

xn--nqv986be9r.com

grpgg2021.space

michaelsarcona.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\920e626bea0e4949daea75e2a332f481_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\920e626bea0e4949daea75e2a332f481_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Users\Admin\AppData\Local\Temp\920e626bea0e4949daea75e2a332f481_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\920e626bea0e4949daea75e2a332f481_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2488-6-0x00000000047B0000-0x0000000004804000-memory.dmp

    Filesize

    336KB

  • memory/2488-1-0x0000000073FB0000-0x000000007469E000-memory.dmp

    Filesize

    6.9MB

  • memory/2488-2-0x0000000001220000-0x0000000001260000-memory.dmp

    Filesize

    256KB

  • memory/2488-3-0x00000000003B0000-0x00000000003C2000-memory.dmp

    Filesize

    72KB

  • memory/2488-4-0x0000000073FB0000-0x000000007469E000-memory.dmp

    Filesize

    6.9MB

  • memory/2488-5-0x0000000001220000-0x0000000001260000-memory.dmp

    Filesize

    256KB

  • memory/2488-0-0x0000000001310000-0x00000000013A2000-memory.dmp

    Filesize

    584KB

  • memory/2488-14-0x0000000073FB0000-0x000000007469E000-memory.dmp

    Filesize

    6.9MB

  • memory/2932-7-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2932-9-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2932-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2932-13-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2932-15-0x00000000008D0000-0x0000000000BD3000-memory.dmp

    Filesize

    3.0MB