xloader | d567a6e6ac075533ef1960033ab07c0afed9638c785ccb3a9461195785ac9636

General

Target

ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
Size

337KB
MD5

ce5a9b1b89a57e526ee1347645b25000
SHA1

a30d421092b052f05ad0861c63d720404805bdcc
SHA256

d567a6e6ac075533ef1960033ab07c0afed9638c785ccb3a9461195785ac9636
SHA512

9db51bc3a0199f2cd374edd9f92c250dfb36670bd1bb76398241c1a0604502e00106c439cee31ffe0e79ee14e8ba89962e95a878e7f30c5bd855f2c8fe4afc80
SSDEEP

6144:e0tgMkhBORh50cUZzKDj8jd8EM4lnt91AMv4o4EE77DqOKyOmRQBQ7Y:dSBaPYyAm4ljyF7/qOKmRg

Score

10^/10

xloader fqiq loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

fqiq

Decoy

driventow.com

ipatchwork.today

bolder.equipment

seal-brother.com

mountlaketerraceapartments.com

weeden.xyz

sanlifalan.com

athafood.com

isshinn1.com

creationslazzaroni.com

eclecticrenaissancewoman.com

satellitephonstore.com

cotchildcare.com

yamacorp.digital

ff4cuno43.xyz

quicksticks.community

govindfinance.com

farmersfirstseed.com

megacinema.club

tablescaperendezvous4two.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1700-11-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe

description	pid	process	target process
PID 2880 set thread context of 1700	2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exece5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe

pid	process
2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
1700	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2880 ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880

C:\Users\Admin\AppData\Local\Temp\ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe"
2⤵
PID:2892

C:\Users\Admin\AppData\Local\Temp\ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe"
2⤵
PID:2580

C:\Users\Admin\AppData\Local\Temp\ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1700

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-7-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1700-13-0x0000000000BA0000-0x0000000000EA3000-memory.dmp

Filesize
3.0MB

Download
memory/1700-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1700-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1700-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2880-3-0x0000000000450000-0x000000000045A000-memory.dmp

Filesize
40KB

Download
memory/2880-6-0x00000000043E0000-0x0000000004432000-memory.dmp

Filesize
328KB

Download
memory/2880-5-0x0000000004C90000-0x0000000004CD0000-memory.dmp

Filesize
256KB

Download
memory/2880-4-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2880-0-0x0000000000B40000-0x0000000000B9A000-memory.dmp

Filesize
360KB

Download
memory/2880-2-0x0000000004C90000-0x0000000004CD0000-memory.dmp

Filesize
256KB

Download
memory/2880-1-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2880-12-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download

description	pid	process	target process
PID 2880 wrote to memory of 2892	2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
PID 2880 wrote to memory of 2892	2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
PID 2880 wrote to memory of 2892	2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
PID 2880 wrote to memory of 2892	2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
PID 2880 wrote to memory of 2580	2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
PID 2880 wrote to memory of 2580	2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
PID 2880 wrote to memory of 2580	2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
PID 2880 wrote to memory of 2580	2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
PID 2880 wrote to memory of 1700	2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
PID 2880 wrote to memory of 1700	2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
PID 2880 wrote to memory of 1700	2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
PID 2880 wrote to memory of 1700	2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
PID 2880 wrote to memory of 1700	2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
PID 2880 wrote to memory of 1700	2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe
PID 2880 wrote to memory of 1700	2880	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe	ce5a9b1b89a57e526ee1347645b25000_JaffaCakes118.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads