xloader | 89b049bc712096512185d1607a9318c074885b2d5b529e0985dc92cdd94d1f51

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-04-2024 00:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
Size

331KB
MD5

c5aac4e454e89b83d6e599440a81d089
SHA1

db0eb6681e072e0290e179465bbf0acfb67193b4
SHA256

89b049bc712096512185d1607a9318c074885b2d5b529e0985dc92cdd94d1f51
SHA512

b3f4d78c98c334049b81e85b6a5774daeb83fdde91d981231d6e1d630bb6857dad415a82525591c5fac4f67205f40a3fa8a825ceed9968a6b68ad7ac360978c7
SSDEEP

6144:vKnmJbfuFhi3ddhGzCQjSK96mTgmxnE8vBfR4uhAgSuB/esFVQE9+MkhB:v/2hofh+CQjtF0mxnEQB/AgTB/espnSB

Score

10^/10

xloader fqiq loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

fqiq

Decoy

driventow.com

ipatchwork.today

bolder.equipment

seal-brother.com

mountlaketerraceapartments.com

weeden.xyz

sanlifalan.com

athafood.com

isshinn1.com

creationslazzaroni.com

eclecticrenaissancewoman.com

satellitephonstore.com

cotchildcare.com

yamacorp.digital

ff4cuno43.xyz

quicksticks.community

govindfinance.com

farmersfirstseed.com

megacinema.club

tablescaperendezvous4two.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2820-11-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe

description	pid	process	target process
PID 2208 set thread context of 2820	2208	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe

pid process

2820 c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe

pid	process
2820	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe

description	pid	process	target process
PID 2208 wrote to memory of 2820	2208	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
PID 2208 wrote to memory of 2820	2208	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
PID 2208 wrote to memory of 2820	2208	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
PID 2208 wrote to memory of 2820	2208	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
PID 2208 wrote to memory of 2820	2208	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
PID 2208 wrote to memory of 2820	2208	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
PID 2208 wrote to memory of 2820	2208	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2208

C:\Users\Admin\AppData\Local\Temp\c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2820

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-6-0x00000000047D0000-0x0000000004822000-memory.dmp

Filesize
328KB

Download
memory/2208-1-0x00000000746F0000-0x0000000074DDE000-memory.dmp

Filesize
6.9MB

Download
memory/2208-2-0x0000000002190000-0x00000000021D0000-memory.dmp

Filesize
256KB

Download
memory/2208-3-0x0000000000420000-0x000000000042A000-memory.dmp

Filesize
40KB

Download
memory/2208-4-0x00000000746F0000-0x0000000074DDE000-memory.dmp

Filesize
6.9MB

Download
memory/2208-5-0x0000000002190000-0x00000000021D0000-memory.dmp

Filesize
256KB

Download
memory/2208-0-0x0000000000B20000-0x0000000000B7A000-memory.dmp

Filesize
360KB

Download
memory/2208-12-0x00000000746F0000-0x0000000074DDE000-memory.dmp

Filesize
6.9MB

Download
memory/2820-7-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2820-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2820-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2820-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2820-13-0x0000000000B80000-0x0000000000E83000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads