xloader | 0bb2dadcdeaff57f676d59b05cf9a787669403dceabe43fd008995b2a0a8b9dd

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/04/2024, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b8278e92923b15789354b41cc89b638f_JaffaCakes118.exe
Size 249KB
Sample240404-pgzwvaeh31
SHA256 0bb2dadcdeaff57f676d59b05cf9a787669403dceabe43fd008995b2a0a8b9dd
MD5 b8278e92923b15789354b41cc89b638f
SHA1 9e4dc8a87d8ca82c8220ff05abed303e899b3822
SHA512 6c948ef9eb3781aca24ab411d4bba93fff5ec052baa622b9fcb026edd3ead6098b5e371381cc398c91fae92ae9ac308450e08515a47d3b2b2ded682c51715418
SSDEEP 6144:wBlL/ctqWfthdLZMNnOasGazR/Ejfk7gfPDZJElCI/hNEt1A:CetqWfdV+LDaF8DgWDZUCI/EzA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xloader noha loader rat

Malware Config

Extracted

Family

xloader

Version

Campaign

noha

Decoy

iphone13promax.support
trailer-racks.xyz
overseaspoolservice.com
r2d2u.com
dawajeju.com
nextgenproxyvote.com
xn--vhqp8mm8dbtz.group
commonsenserisk.com
cmcqgxtyd.com
data2form.com
bois-applique.com
originallollipop.com
lj0008lj.net
spfldvaccineday.info
phalcosnusa.com
llcmastermachine.com
onlyforu14.rest
bestmarketingautomations.com
officialswitchmusic.com
thepretenseofjustice.com
authenticradio.net
standardizedsubmissions.com
aegnoshipping.com
478762.com
inclusionchecks.com
number-is-04.net
yyds9527.space
big-thought.com
controle2.email
groupninemed.com
fisworkdeck.com
imonbayazid.com
pixlrz.com
headlinebysmp.com
simulatefuck.com
efficientmother.com
wkshops22012.xyz
artehamburguer.com
beauallenpoetry.com
bonairemarathon.com
sprintfingers.com
ranbix.com
denghaoxin.club
jillianvansice.com
purpledge.com
mariadimitropoulou.com
surveyplanetgroup.tech
apocalyptoapertureserrature.net
cbd-cannabis.store
dirtcheapfire.com
xn--zbss74a16j.xn--czru2d
auth-appsgo.com
estchemdelat.space
kweeka.money
marketingtipsntricks.com
dayandwestbeauty.com
paddlercentral.com
nongminle.net
aodesai.store
evtasimaucretleri.com
micj7873.com
unarecord.com
zsnhviig.xyz
hallmark-transport.com
mglracing.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2988-8-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

pid	Process
2948	b8278e92923b15789354b41cc89b638f_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2948 set thread context of 2988	2948	b8278e92923b15789354b41cc89b638f_JaffaCakes118.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2988	b8278e92923b15789354b41cc89b638f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2988	2948	b8278e92923b15789354b41cc89b638f_JaffaCakes118.exe	28
PID 2948 wrote to memory of 2988	2948	b8278e92923b15789354b41cc89b638f_JaffaCakes118.exe	28
PID 2948 wrote to memory of 2988	2948	b8278e92923b15789354b41cc89b638f_JaffaCakes118.exe	28
PID 2948 wrote to memory of 2988	2948	b8278e92923b15789354b41cc89b638f_JaffaCakes118.exe	28
PID 2948 wrote to memory of 2988	2948	b8278e92923b15789354b41cc89b638f_JaffaCakes118.exe	28
PID 2948 wrote to memory of 2988	2948	b8278e92923b15789354b41cc89b638f_JaffaCakes118.exe	28
PID 2948 wrote to memory of 2988	2948	b8278e92923b15789354b41cc89b638f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\b8278e92923b15789354b41cc89b638f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b8278e92923b15789354b41cc89b638f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\b8278e92923b15789354b41cc89b638f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b8278e92923b15789354b41cc89b638f_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ukjqjohi.dll

Path \Users\Admin\AppData\Local\Temp\nst452C.tmp\ukjqjohi.dll
Size 28KB
SHA256 47d6f407abc8d7fe10076e0ef6dbf7f2d843e2e481a280ec79d58f1edf06574b
MD5 4a461edac312daf734fc0b0a1e7d1169
SHA1 bf3f1e23bf93340481bf8abf4338db4d4a22df27
SHA512 3544e5fe8c2de40ca5c1f494c0b3bf7996aeefde05edc1041eed5592f3d07aa5e2741bfd253bb875c4440e673fdc0c3b574d98287b696ef5b2b40c45d64f24f1
SSDEEP 768:ol7pb0KAbav/xDCKHj13xDv//6bbtxD7:6OL2xvXMTD7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2988-8-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2988-10-0x0000000000770000-0x0000000000A73000-memory.dmp

Download