Analysis
- max time kernel
91s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
04/04/2024, 12:04
General
- Target b7db705d5402da2662b9f339a8a06085_JaffaCakes118.exe
- Size 355KB
- Sample240404-n8ymesfc86
- SHA256 367e0400b78d94aed02d364e9a8e41dfb7e0136f12e68dd1b532d529354e00f7
Malware Config
Extracted
-
xloader
-
2.5
-
yjqn
-
ittybittybunnies.com
-
flordedesierto.com
-
cum.care
-
petshomespace.com
-
verputzarbeit.com
-
yuvajanmat.com
-
getlie.com
-
finanes.xyz
-
thelazyrando.com
-
domelite.design
-
yukinko-takasu.com
-
pontosmensal.com
-
maurlinoconstruction.com
-
getelectronow.com
-
newmexicocarwrecklawfirm.com
-
gunnbucks.com
-
ncsy30.xyz
-
opsem.info
-
authorisewallet.com
-
scchanghe.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7db705d5402da2662b9f339a8a06085_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7db705d5402da2662b9f339a8a06085_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b7db705d5402da2662b9f339a8a06085_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7db705d5402da2662b9f339a8a06085_JaffaCakes118.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b7db705d5402da2662b9f339a8a06085_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b7db705d5402da2662b9f339a8a06085_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1264-13-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1264-17-0x0000000001510000-0x000000000185A000-memory.dmp
memory/1264-16-0x0000000001510000-0x000000000185A000-memory.dmp
memory/3556-8-0x00000000750B0000-0x0000000075860000-memory.dmp
memory/3556-10-0x0000000005280000-0x0000000005290000-memory.dmp
memory/3556-5-0x0000000005210000-0x000000000521A000-memory.dmp
memory/3556-6-0x0000000005280000-0x0000000005290000-memory.dmp
memory/3556-7-0x0000000008820000-0x000000000882E000-memory.dmp
memory/3556-0-0x0000000000790000-0x00000000007F0000-memory.dmp
memory/3556-9-0x0000000005280000-0x0000000005290000-memory.dmp
memory/3556-4-0x0000000005280000-0x0000000005290000-memory.dmp
memory/3556-11-0x0000000008CC0000-0x0000000008D5C000-memory.dmp
memory/3556-12-0x0000000008E00000-0x0000000008E52000-memory.dmp
memory/3556-3-0x0000000005050000-0x00000000050E2000-memory.dmp
memory/3556-15-0x00000000750B0000-0x0000000075860000-memory.dmp
memory/3556-2-0x0000000005500000-0x0000000005AA4000-memory.dmp
memory/3556-1-0x00000000750B0000-0x0000000075860000-memory.dmp