xloader | 8fbd9e0de6ff63af1fdef9c836ca62f662c1bfd091dc2fe046cfa266d4b27bd0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e97a56b53d4cda1a7bbe5b950fac1648_JaffaCakes118.exe
Size

936KB
MD5

e97a56b53d4cda1a7bbe5b950fac1648
SHA1

7449b26c27643685e568cde811d82b2105270073
SHA256

8fbd9e0de6ff63af1fdef9c836ca62f662c1bfd091dc2fe046cfa266d4b27bd0
SHA512

4b9a4c02aa2b3233add599452804dd11358700750a7b834748796588907b68a7493ccacb7a8a239708f939659cdc4c3dcf29caa67868f6a6be9dcbaac04ec048
SSDEEP

12288:OVg0y1/ug8NSc07iS/d348yoBoRoDoyoo38Z9dVhDs6zvwIXvP6mjH9DXF9tGQMI:Byg8jS/d3YK64JS66zvTXvrxV3Iq

Score

10^/10

xloader p2io loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

p2io

Decoy

essentiallyourscandles.com

cleanxcare.com

bigplatesmallwallet.com

iotcloud.technology

dmgt4m2g8y2uh.net

malcorinmobiliaria.com

thriveglucose.com

fuhaitongxin.com

magetu.info

pyithuhluttaw.net

myfavbutik.com

xzklrhy.com

anewdistraction.com

mercuryaid.net

thesoulrevitalist.com

swayam-moj.com

liminaltechnology.com

lucytime.com

alfenas.info

carmelodesign.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral1/memory/2204-3-0x00000000003A0000-0x00000000003B2000-memory.dmp	CustAttr

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2568-14-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2204 set thread context of 2568	2204	e97a56b53d4cda1a7bbe5b950fac1648_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2568	e97a56b53d4cda1a7bbe5b950fac1648_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2568	2204	e97a56b53d4cda1a7bbe5b950fac1648_JaffaCakes118.exe	28
PID 2204 wrote to memory of 2568	2204	e97a56b53d4cda1a7bbe5b950fac1648_JaffaCakes118.exe	28
PID 2204 wrote to memory of 2568	2204	e97a56b53d4cda1a7bbe5b950fac1648_JaffaCakes118.exe	28
PID 2204 wrote to memory of 2568	2204	e97a56b53d4cda1a7bbe5b950fac1648_JaffaCakes118.exe	28
PID 2204 wrote to memory of 2568	2204	e97a56b53d4cda1a7bbe5b950fac1648_JaffaCakes118.exe	28
PID 2204 wrote to memory of 2568	2204	e97a56b53d4cda1a7bbe5b950fac1648_JaffaCakes118.exe	28
PID 2204 wrote to memory of 2568	2204	e97a56b53d4cda1a7bbe5b950fac1648_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\e97a56b53d4cda1a7bbe5b950fac1648_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e97a56b53d4cda1a7bbe5b950fac1648_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\e97a56b53d4cda1a7bbe5b950fac1648_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e97a56b53d4cda1a7bbe5b950fac1648_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2204-7-0x00000000007A0000-0x00000000007D0000-memory.dmp

Filesize
192KB

Download
memory/2204-1-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2204-2-0x0000000004E10000-0x0000000004E50000-memory.dmp

Filesize
256KB

Download
memory/2204-3-0x00000000003A0000-0x00000000003B2000-memory.dmp

Filesize
72KB

Download
memory/2204-4-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2204-5-0x0000000004E10000-0x0000000004E50000-memory.dmp

Filesize
256KB

Download
memory/2204-0-0x00000000013B0000-0x00000000014A0000-memory.dmp

Filesize
960KB

Download
memory/2204-6-0x0000000004F50000-0x0000000004FC8000-memory.dmp

Filesize
480KB

Download
memory/2204-15-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2568-16-0x0000000000A20000-0x0000000000D23000-memory.dmp

Filesize
3.0MB

Download
memory/2568-14-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2568-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2568-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2568-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download