xloader | 506458aaeef61f70cf73da3d71d5452cd859cfd9fbcc7cf515d27265ace2421d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04-04-2024 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe
Size

425KB
MD5

c0e07faebfd4b0977ac802e3bc73958a
SHA1

0277d0bc9bc70b7b013adb9e7500dd0cbd0b863e
SHA256

506458aaeef61f70cf73da3d71d5452cd859cfd9fbcc7cf515d27265ace2421d
SHA512

7ce148455e4a6152ac5ede04e595cafcb5e9363efc0d79552726a34fc1b7b595028758774d4358f581ec12a1a0a8823e5aa2dcc226a20763d32f17c95d6aa752
SSDEEP

6144:i6Uqd2GhNOQVwKtCcaEyfM2Q4NmbBggh13Rtm1DnMaKvzmr3:fUi2iNOQVlVPOTpqBtUDnMamQ

Score

10^/10

xloader euzn loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euzn

Decoy

235296tyc.com

gold12guide.art

baibuaherb.com

weberwines.tax

chezvitoria.com

aidenb.tech

pitchdeckservice.com

surgeryforfdf.xyz

workunvaccinated.com

hrtaro.com

yourotcs.com

sonimultispecialityclinic.com

consultantadvisors.com

pentesting-consulting.com

dantechs.digital

longshifa.online

taweilai.net

imyusuke.com

cashndashfinancial.com

fasiglimt.quest

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2548-13-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe

description	pid	process	target process
PID 2268 set thread context of 2548	2268	c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe	c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe

pid process

2548 c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe

pid	process
2548	c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe

description	pid	process	target process
PID 2268 wrote to memory of 2548	2268	c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe	c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe
PID 2268 wrote to memory of 2548	2268	c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe	c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe
PID 2268 wrote to memory of 2548	2268	c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe	c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe
PID 2268 wrote to memory of 2548	2268	c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe	c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe
PID 2268 wrote to memory of 2548	2268	c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe	c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe
PID 2268 wrote to memory of 2548	2268	c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe	c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe
PID 2268 wrote to memory of 2548	2268	c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe	c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2268

C:\Users\Admin\AppData\Local\Temp\c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c0e07faebfd4b0977ac802e3bc73958a_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2548

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2268-6-0x00000000048A0000-0x00000000048F2000-memory.dmp

Filesize
328KB

Download
memory/2268-1-0x0000000074670000-0x0000000074D5E000-memory.dmp

Filesize
6.9MB

Download
memory/2268-2-0x0000000000460000-0x00000000004A0000-memory.dmp

Filesize
256KB

Download
memory/2268-3-0x0000000000440000-0x000000000044E000-memory.dmp

Filesize
56KB

Download
memory/2268-4-0x0000000074670000-0x0000000074D5E000-memory.dmp

Filesize
6.9MB

Download
memory/2268-5-0x0000000000460000-0x00000000004A0000-memory.dmp

Filesize
256KB

Download
memory/2268-0-0x0000000001110000-0x0000000001180000-memory.dmp

Filesize
448KB

Download
memory/2268-14-0x0000000074670000-0x0000000074D5E000-memory.dmp

Filesize
6.9MB

Download
memory/2548-7-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2548-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2548-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2548-13-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2548-15-0x0000000000700000-0x0000000000A03000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads