xloader | 89b049bc712096512185d1607a9318c074885b2d5b529e0985dc92cdd94d1f51

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 00:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
Size

331KB
MD5

c5aac4e454e89b83d6e599440a81d089
SHA1

db0eb6681e072e0290e179465bbf0acfb67193b4
SHA256

89b049bc712096512185d1607a9318c074885b2d5b529e0985dc92cdd94d1f51
SHA512

b3f4d78c98c334049b81e85b6a5774daeb83fdde91d981231d6e1d630bb6857dad415a82525591c5fac4f67205f40a3fa8a825ceed9968a6b68ad7ac360978c7
SSDEEP

6144:vKnmJbfuFhi3ddhGzCQjSK96mTgmxnE8vBfR4uhAgSuB/esFVQE9+MkhB:v/2hofh+CQjtF0mxnEQB/AgTB/espnSB

Score

10^/10

xloader fqiq loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

fqiq

Decoy

driventow.com

ipatchwork.today

bolder.equipment

seal-brother.com

mountlaketerraceapartments.com

weeden.xyz

sanlifalan.com

athafood.com

isshinn1.com

creationslazzaroni.com

eclecticrenaissancewoman.com

satellitephonstore.com

cotchildcare.com

yamacorp.digital

ff4cuno43.xyz

quicksticks.community

govindfinance.com

farmersfirstseed.com

megacinema.club

tablescaperendezvous4two.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2088-11-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe

description	pid	process	target process
PID 2364 set thread context of 2088	2364	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe

pid process

2088 c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
2088 c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe

pid	process
2088	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
2088	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe

description	pid	process	target process
PID 2364 wrote to memory of 2088	2364	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
PID 2364 wrote to memory of 2088	2364	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
PID 2364 wrote to memory of 2088	2364	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
PID 2364 wrote to memory of 2088	2364	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
PID 2364 wrote to memory of 2088	2364	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
PID 2364 wrote to memory of 2088	2364	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe	c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2364

C:\Users\Admin\AppData\Local\Temp\c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c5aac4e454e89b83d6e599440a81d089_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3788 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:4720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2088-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2088-14-0x0000000001040000-0x000000000138A000-memory.dmp

Filesize
3.3MB

Download
memory/2364-6-0x0000000005A30000-0x0000000005A3A000-memory.dmp

Filesize
40KB

Download
memory/2364-3-0x0000000005800000-0x0000000005892000-memory.dmp

Filesize
584KB

Download
memory/2364-4-0x0000000005700000-0x0000000005710000-memory.dmp

Filesize
64KB

Download
memory/2364-5-0x00000000057A0000-0x00000000057AA000-memory.dmp

Filesize
40KB

Download
memory/2364-0-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/2364-7-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/2364-8-0x0000000005700000-0x0000000005710000-memory.dmp

Filesize
64KB

Download
memory/2364-9-0x0000000006FC0000-0x000000000705C000-memory.dmp

Filesize
624KB

Download
memory/2364-10-0x00000000070B0000-0x0000000007102000-memory.dmp

Filesize
328KB

Download
memory/2364-2-0x0000000005D10000-0x00000000062B4000-memory.dmp

Filesize
5.6MB

Download
memory/2364-13-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/2364-1-0x0000000000D70000-0x0000000000DCA000-memory.dmp

Filesize
360KB

Download