Analysis
- max time kernel
121s - max time network
122s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
05/04/2024, 03:25
General
- Target c973e16041f13ff85a30dfe58b3bf5ad_JaffaCakes118.exe
- Size 590KB
- Sample240405-dyp77abf34
- SHA256 e4f8b98f8e13c39a8a37fe7f2ac39f76790ae154a1a47941d889c663675e970e
Malware Config
Extracted
-
xloader
-
2.5
-
i6rd
-
ritotvmount.xyz
-
szxhpfk.com
-
yatakturkiye.com
-
belugacdn.xyz
-
doralopen.com
-
gongzyrxzlhurhhhvdclmddi.store
-
lyvconsulting.com
-
it-pampering.com
-
weerwi.com
-
phdelivery1.store
-
neofluentsurf.com
-
lainsurance.xyz
-
ietaricardocastellarbarrios.com
-
despachantemedeiros.digital
-
madnext.online
-
serenity.holdings
-
rfvb.club
-
nickroche.online
-
hnjst.net
-
wolkeverts.quest
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c973e16041f13ff85a30dfe58b3bf5ad_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c973e16041f13ff85a30dfe58b3bf5ad_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c973e16041f13ff85a30dfe58b3bf5ad_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c973e16041f13ff85a30dfe58b3bf5ad_JaffaCakes118.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\c973e16041f13ff85a30dfe58b3bf5ad_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c973e16041f13ff85a30dfe58b3bf5ad_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1044-6-0x0000000005B90000-0x0000000005BF8000-memory.dmp
memory/1044-1-0x00000000740B0000-0x000000007479E000-memory.dmp
memory/1044-2-0x0000000004AA0000-0x0000000004AE0000-memory.dmp
memory/1044-3-0x0000000000470000-0x0000000000488000-memory.dmp
memory/1044-4-0x00000000740B0000-0x000000007479E000-memory.dmp
memory/1044-5-0x0000000004AA0000-0x0000000004AE0000-memory.dmp
memory/1044-0-0x0000000000930000-0x00000000009CA000-memory.dmp
memory/1044-12-0x00000000740B0000-0x000000007479E000-memory.dmp
memory/2692-7-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2692-8-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2692-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2692-11-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2692-13-0x0000000000B60000-0x0000000000E63000-memory.dmp