Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
09/04/2024, 02:25
General
- Target e8ffcbc409061c90c88be282c1b8b0d0_JaffaCakes118.exe
- Size 843KB
- Sample240409-cwgbtsfc6v
- SHA256 93e54839118561584c3e736d6b03acfbec1373cfe5b9b9dffdb3d57e96be7d4a
Malware Config
Extracted
-
xloader
-
2.3
-
n58i
-
nl-cafe.com
-
votetedjaleta.com
-
britrobertsrealtor.com
-
globipark.com
-
citysucces.com
-
verisignwebsite-verified.com
-
riddlepc.com
-
rosecityclimbing.com
-
oleandrinextract.com
-
salmankonstruksi.com
-
needhamchannel.com
-
refreshx2z.com
-
youth66.com
-
pla-russia.com
-
halloweenmaskpro.com
-
exdysis.com
-
1gcz.com
-
lookgoodman.com
-
rlxagva.com
-
stlcityc.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\e8ffcbc409061c90c88be282c1b8b0d0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e8ffcbc409061c90c88be282c1b8b0d0_JaffaCakes118.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2864-13-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2864-22-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2864-23-0x0000000003590000-0x00000000035A1000-memory.dmp
memory/2864-19-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2864-18-0x0000000001730000-0x0000000001741000-memory.dmp
memory/2864-17-0x00000000017A0000-0x0000000001AEA000-memory.dmp
memory/3460-25-0x0000000008C30000-0x0000000008DCE000-memory.dmp
memory/3460-24-0x0000000008C30000-0x0000000008DCE000-memory.dmp
memory/3460-20-0x0000000004A10000-0x0000000004AD4000-memory.dmp
memory/4604-5-0x0000000004D60000-0x0000000004D70000-memory.dmp
memory/4604-7-0x0000000004DD0000-0x0000000004E26000-memory.dmp
memory/4604-11-0x0000000007700000-0x00000000077B0000-memory.dmp
memory/4604-12-0x0000000009E70000-0x0000000009EB0000-memory.dmp
memory/4604-9-0x0000000074FC0000-0x0000000075770000-memory.dmp
memory/4604-15-0x0000000074FC0000-0x0000000075770000-memory.dmp
memory/4604-8-0x00000000050C0000-0x00000000050D8000-memory.dmp
memory/4604-10-0x0000000004D60000-0x0000000004D70000-memory.dmp
memory/4604-6-0x0000000004AB0000-0x0000000004ABA000-memory.dmp
memory/4604-0-0x0000000000030000-0x0000000000108000-memory.dmp
memory/4604-4-0x0000000004B90000-0x0000000004C22000-memory.dmp
memory/4604-3-0x0000000005140000-0x00000000056E4000-memory.dmp
memory/4604-2-0x0000000004AF0000-0x0000000004B8C000-memory.dmp
memory/4604-1-0x0000000074FC0000-0x0000000075770000-memory.dmp