Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    03-04-2024 02:55

General

  • Target

    9e2c5b22680ba4bbd6a878359de06f25_JaffaCakes118.exe

  • Size

    473KB

  • MD5

    9e2c5b22680ba4bbd6a878359de06f25

  • SHA1

    0fd148f8548e00ce55546cb8f47c7ed45a91b33d

  • SHA256

    76ae8a066744d281de1a7b1db736994aee95488fdf4bb8721f82348236e87521

  • SHA512

    bba4977afd82b635fc2f4071996d7dc501afe80ad8c92da202559b0966182b2394e64c963dcdc8efa3871f65e54460f26b8b226db01c1e67752e7cd2a58b82d6

  • SSDEEP

    6144:c2VKqAFfdPb+Gg+RxG5Rq8OC8zo3mV2Ex5SjOSB48OYIOqC1cJsoDvjllYj:BVKqAFfdKGleRTOiI76jG8OYIx4Svoj

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

s9ns

Decoy

livehd7.onl

comprosuasucata.com

rouvar.com

zamenapodani.quest

villahummingbird.com

vendaaprovadanosite.com

activeator.com

lapinlauluveikot.com

watch-tbn.net

schwesteroutfits.com

viviendactiva.com

quaythuocquynhchi.xyz

dasrekop.online

ch34k-3yfb124.club

fxb2bhub.com

lightlyenlightened.com

workdayconvert.com

pintod.com

mariimportados.com

globoicon.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e2c5b22680ba4bbd6a878359de06f25_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9e2c5b22680ba4bbd6a878359de06f25_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Users\Admin\AppData\Local\Temp\9e2c5b22680ba4bbd6a878359de06f25_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\9e2c5b22680ba4bbd6a878359de06f25_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2624-7-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2624-13-0x00000000008E0000-0x0000000000BE3000-memory.dmp

    Filesize

    3.0MB

  • memory/2624-11-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2624-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2624-8-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/2964-3-0x0000000000450000-0x000000000045E000-memory.dmp

    Filesize

    56KB

  • memory/2964-6-0x0000000004890000-0x00000000048E2000-memory.dmp

    Filesize

    328KB

  • memory/2964-5-0x0000000004F00000-0x0000000004F40000-memory.dmp

    Filesize

    256KB

  • memory/2964-4-0x0000000074B40000-0x000000007522E000-memory.dmp

    Filesize

    6.9MB

  • memory/2964-0-0x00000000013C0000-0x000000000143C000-memory.dmp

    Filesize

    496KB

  • memory/2964-2-0x0000000004F00000-0x0000000004F40000-memory.dmp

    Filesize

    256KB

  • memory/2964-12-0x0000000074B40000-0x000000007522E000-memory.dmp

    Filesize

    6.9MB

  • memory/2964-1-0x0000000074B40000-0x000000007522E000-memory.dmp

    Filesize

    6.9MB