Analysis
- max time kernel
93s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
04/04/2024, 22:26
General
- Target c357a8010e661a49df2e813bd22590b6_JaffaCakes118.exe
- Size 329KB
- Sample240404-2cyt7scd96
- SHA256 eef137583da6deb4a1be9882cede6cec5112b74ae79c0773f45b13346c5b2890
Malware Config
Extracted
-
xloader
-
2.5
-
ag9v
-
wordmagicshow.com
-
dogparkdate.com
-
quickcarehomeopathic.com
-
azwar.net
-
louisle1909.xyz
-
section8lv.com
-
felineness.com
-
2888sy.com
-
wadashoot.com
-
kittyuniverse.com
-
blushroses.com
-
alaskangeneral.com
-
yumoo.design
-
7xkfic.com
-
891827.com
-
uspress1.com
-
aceserial.xyz
-
muellerconfidence.com
-
eramakport.com
-
tipsandtoesnewton.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c357a8010e661a49df2e813bd22590b6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c357a8010e661a49df2e813bd22590b6_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c357a8010e661a49df2e813bd22590b6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c357a8010e661a49df2e813bd22590b6_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1444-6-0x00000000055C0000-0x00000000055CA000-memory.dmp
memory/1444-10-0x0000000006BB0000-0x0000000006C02000-memory.dmp
memory/1444-2-0x0000000005870000-0x0000000005E14000-memory.dmp
memory/1444-3-0x0000000005360000-0x00000000053F2000-memory.dmp
memory/1444-4-0x0000000002D50000-0x0000000002D60000-memory.dmp
memory/1444-5-0x0000000002D60000-0x0000000002D6A000-memory.dmp
memory/1444-1-0x00000000749D0000-0x0000000075180000-memory.dmp
memory/1444-8-0x0000000002D50000-0x0000000002D60000-memory.dmp
memory/1444-0-0x0000000000880000-0x00000000008D8000-memory.dmp
memory/1444-9-0x0000000006B10000-0x0000000006BAC000-memory.dmp
memory/1444-7-0x00000000749D0000-0x0000000075180000-memory.dmp
memory/1444-13-0x00000000749D0000-0x0000000075180000-memory.dmp
memory/3776-11-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3776-14-0x0000000001990000-0x0000000001CDA000-memory.dmp
memory/3776-15-0x0000000001990000-0x0000000001CDA000-memory.dmp