xloader | b61e941f98080f431ec35c165703e2d18957fcc2b386286eeaa7a274ded8e0b3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6d4647120718672e95e07913988ace9_JaffaCakes118.exe
Size

1.1MB
MD5

e6d4647120718672e95e07913988ace9
SHA1

245239c43c3146ee41de1f46528cea3f26f1a6b0
SHA256

b61e941f98080f431ec35c165703e2d18957fcc2b386286eeaa7a274ded8e0b3
SHA512

6af5c0f30a1813bca04216f04bf370f2ce008353fbb31f250aace6007fe29f959eb82f046b8ae3ee131d580f8af8d15174f427782c3175f35d99ee0503e517eb
SSDEEP

12288:PxU4yNKC3L//TuZErIbjSmoXE2luLHPKHW2kQQStKe41OexZnyV+:P+HKSLKZHbVoX3uLHPKW7/

Score

10^/10

xloader ipa8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ipa8

Decoy

royalposhpups.com

univa.world

lanerbo.com

shopbabygo.com

theutahhomestore.com

serialmixer.icu

linfeiya.com

xn--12cg3de5c2eb5cyi.com

am-conseil-communication.com

dailygame168.com

therightmilitia.com

visions-agency.com

mapopi.com

frugallyketo.com

guapandglo.com

54w-x126v.net

your-health-kick.com

blockchainhub360.com

registernowhd.xyz

votekellykitashima.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2708-12-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

e6d4647120718672e95e07913988ace9_JaffaCakes118.exe

description	pid	process	target process
PID 2364 set thread context of 2708	2364	e6d4647120718672e95e07913988ace9_JaffaCakes118.exe	e6d4647120718672e95e07913988ace9_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e6d4647120718672e95e07913988ace9_JaffaCakes118.exe

pid process

2708 e6d4647120718672e95e07913988ace9_JaffaCakes118.exe

pid	process
2708	e6d4647120718672e95e07913988ace9_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

e6d4647120718672e95e07913988ace9_JaffaCakes118.exe

description	pid	process	target process
PID 2364 wrote to memory of 2708	2364	e6d4647120718672e95e07913988ace9_JaffaCakes118.exe	e6d4647120718672e95e07913988ace9_JaffaCakes118.exe
PID 2364 wrote to memory of 2708	2364	e6d4647120718672e95e07913988ace9_JaffaCakes118.exe	e6d4647120718672e95e07913988ace9_JaffaCakes118.exe
PID 2364 wrote to memory of 2708	2364	e6d4647120718672e95e07913988ace9_JaffaCakes118.exe	e6d4647120718672e95e07913988ace9_JaffaCakes118.exe
PID 2364 wrote to memory of 2708	2364	e6d4647120718672e95e07913988ace9_JaffaCakes118.exe	e6d4647120718672e95e07913988ace9_JaffaCakes118.exe
PID 2364 wrote to memory of 2708	2364	e6d4647120718672e95e07913988ace9_JaffaCakes118.exe	e6d4647120718672e95e07913988ace9_JaffaCakes118.exe
PID 2364 wrote to memory of 2708	2364	e6d4647120718672e95e07913988ace9_JaffaCakes118.exe	e6d4647120718672e95e07913988ace9_JaffaCakes118.exe
PID 2364 wrote to memory of 2708	2364	e6d4647120718672e95e07913988ace9_JaffaCakes118.exe	e6d4647120718672e95e07913988ace9_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e6d4647120718672e95e07913988ace9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e6d4647120718672e95e07913988ace9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2364

C:\Users\Admin\AppData\Local\Temp\e6d4647120718672e95e07913988ace9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e6d4647120718672e95e07913988ace9_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2708

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2364-6-0x00000000004C0000-0x000000000055E000-memory.dmp

Filesize
632KB

Download
memory/2364-1-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2364-2-0x0000000004E60000-0x0000000004EA0000-memory.dmp

Filesize
256KB

Download
memory/2364-3-0x0000000000250000-0x000000000026E000-memory.dmp

Filesize
120KB

Download
memory/2364-4-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2364-5-0x0000000004E60000-0x0000000004EA0000-memory.dmp

Filesize
256KB

Download
memory/2364-0-0x0000000000BA0000-0x0000000000CB6000-memory.dmp

Filesize
1.1MB

Download
memory/2364-7-0x0000000000AC0000-0x0000000000AEE000-memory.dmp

Filesize
184KB

Download
memory/2364-13-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2708-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2708-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2708-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2708-14-0x0000000000CC0000-0x0000000000FC3000-memory.dmp

Filesize
3.0MB

Download
memory/2708-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads