xloader | ede2311b0dc0adf3290cba376e3d855ecd9a59b510107b48b03d30955a092e26

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec16f3d1dca8c3c8366286559ae37eb3_JaffaCakes118.exe
Size

406KB
MD5

ec16f3d1dca8c3c8366286559ae37eb3
SHA1

ee17fabc52414bba3fc44576851358a12f15bbd8
SHA256

ede2311b0dc0adf3290cba376e3d855ecd9a59b510107b48b03d30955a092e26
SHA512

2d36c615141cf4e884e8f33e8aa31290ac6a332a86595a35c826066ba518a59643309634b49c5c6707daeb58274d74f278716a9ecaafbfe4215a0354d4f1f717
SSDEEP

6144:WLTfzVyYWrjsCCFu3L4Ny8tyF+h74xTKlXBRkAzoJT6:efzYFBb4VtBhqiOIR

Score

10^/10

xloader rqe8 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

rqe8

Decoy

bjft.net

abrosnm3.com

badlistens.com

signal-japan.com

schaka.com

kingdompersonalbranding.com

sewmenship.com

lzproperty.com

mojoimpacthosting.com

carinsurancecoverage.care

corporatemercadona.com

mobileswash.com

forevercelebration2026.com

co-het.com

bellesherlou.com

commentsoldgolf.com

onlytwod.group

utesco.info

martstrip.com

onszdgu.icu

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2820-3-0x0000000000080000-0x00000000000A8000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2224 set thread context of 2820	2224	ec16f3d1dca8c3c8366286559ae37eb3_JaffaCakes118.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2884	2820	WerFault.exe	28

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2224	ec16f3d1dca8c3c8366286559ae37eb3_JaffaCakes118.exe
2224	ec16f3d1dca8c3c8366286559ae37eb3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2820	2224	ec16f3d1dca8c3c8366286559ae37eb3_JaffaCakes118.exe	28
PID 2224 wrote to memory of 2820	2224	ec16f3d1dca8c3c8366286559ae37eb3_JaffaCakes118.exe	28
PID 2224 wrote to memory of 2820	2224	ec16f3d1dca8c3c8366286559ae37eb3_JaffaCakes118.exe	28
PID 2224 wrote to memory of 2820	2224	ec16f3d1dca8c3c8366286559ae37eb3_JaffaCakes118.exe	28
PID 2224 wrote to memory of 2820	2224	ec16f3d1dca8c3c8366286559ae37eb3_JaffaCakes118.exe	28
PID 2820 wrote to memory of 2884	2820	ec16f3d1dca8c3c8366286559ae37eb3_JaffaCakes118.exe	29
PID 2820 wrote to memory of 2884	2820	ec16f3d1dca8c3c8366286559ae37eb3_JaffaCakes118.exe	29
PID 2820 wrote to memory of 2884	2820	ec16f3d1dca8c3c8366286559ae37eb3_JaffaCakes118.exe	29
PID 2820 wrote to memory of 2884	2820	ec16f3d1dca8c3c8366286559ae37eb3_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\ec16f3d1dca8c3c8366286559ae37eb3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ec16f3d1dca8c3c8366286559ae37eb3_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\ec16f3d1dca8c3c8366286559ae37eb3_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ec16f3d1dca8c3c8366286559ae37eb3_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 36
    3⤵
    - Program crash
    PID:2884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-2-0x00000000000F0000-0x00000000000F2000-memory.dmp

Filesize
8KB

Download
memory/2224-1-0x00000000003C0000-0x00000000004C0000-memory.dmp

Filesize
1024KB

Download
memory/2820-3-0x0000000000080000-0x00000000000A8000-memory.dmp

Filesize
160KB

Download