Analysis

  • max time kernel
    141s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-04-2024 20:15

General

  • Target

    962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    962ae24141e7b1abf36ae99d1fbc7315

  • SHA1

    bff36581aae1b402d2542190d89faf07fcdd2680

  • SHA256

    61a69b0eb00727462d5599153fb2acb617d15fcc2e9e4ec3270a5fca8837a3ba

  • SHA512

    46f9e98ad3440d8fa079ca7431face86ddf46850de4ee7f5c220ac1fa4738646a6862e0895797d83e52f9b1f24117b7259ac33b02405ac72f0135e8ff33e1072

  • SSDEEP

    24576:196uxv82aMVxkN0m9KYR665AoUv8xmlBp49Ax5v7WPDFIgY:19zjalOm046IArUqi9A7v6ZIJ

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b65i

Decoy

leofighters.com

smartat2.xyz

encontrevariedades.com

jimwilliamstutoring.com

kanpaiecuador.com

accura-inv.com

xtzgjxzz.com

scentstrategies.com

high-clicks2.com

hadishgebray.com

woodlawnbailbonds.com

dmsolutionsco.com

rdvulm21.com

beachyweens.com

ishirmansingh.com

rimmasbracelets.com

kellibrat.com

roselmasm.com

datkamoney.info

fermers.club

Signatures

  • Detect ZGRat V1 1 IoCs
  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe
      2⤵
        PID:4408
      • C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\962ae24141e7b1abf36ae99d1fbc7315_JaffaCakes118.exe
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4472
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:392

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1988-0-0x00000000005B0000-0x00000000006FC000-memory.dmp

        Filesize

        1.3MB

      • memory/1988-1-0x0000000074BF0000-0x00000000753A0000-memory.dmp

        Filesize

        7.7MB

      • memory/1988-2-0x0000000005120000-0x000000000525E000-memory.dmp

        Filesize

        1.2MB

      • memory/1988-3-0x0000000074BF0000-0x00000000753A0000-memory.dmp

        Filesize

        7.7MB

      • memory/1988-4-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

        Filesize

        64KB

      • memory/1988-5-0x00000000050C0000-0x00000000050EE000-memory.dmp

        Filesize

        184KB

      • memory/1988-9-0x0000000074BF0000-0x00000000753A0000-memory.dmp

        Filesize

        7.7MB

      • memory/4472-6-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

      • memory/4472-8-0x0000000001AD0000-0x0000000001E1A000-memory.dmp

        Filesize

        3.3MB