xloader | 39e07d983dda2437d04b37965671e84be2116f882c7c3a689ed137c8e2a1e10a

Analysis

max time kernel
92s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab193344b506b1507675779ebf8c11b_JaffaCakes118.exe
Size

796KB
MD5

eab193344b506b1507675779ebf8c11b
SHA1

75a1f6b30e1e799f5d5e17f169a78872429a562e
SHA256

39e07d983dda2437d04b37965671e84be2116f882c7c3a689ed137c8e2a1e10a
SHA512

5c3d8733e0be02ffdcc3ea576634dd974abe9c8ae5792c21d15f75cea758b73d902b0febfc0648507a0e8cb9c650a5cbe54026a7f117b593e57b2c9a8d0d8246
SSDEEP

12288:2R4KwT/HWmgmzHribIXnU1nEoJ4Vi1/ueJxfIuTyUDlID2iN:2Ry/HNgmzwj0Vi04auWUDlID1

Score

10^/10

xloader wufn loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

wufn

Decoy

rsautoluxe.com

theroseofsharonsalon.com

singnema.com

nathanielwhite108.com

theforumonline.com

iqpt.info

joneshondaservice.com

fafene.com

solanohomebuyerclass.com

zwq.xyz

searchlakeconroehomes.com

briative.com

frystmor.city

systemofyouth.com

sctsmney.com

tv-safetrading.com

thesweetboy.com

occulusblu.com

pawsthemomentpetphotography.com

travelstipsguide.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1636-13-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 508 set thread context of 1636	508	eab193344b506b1507675779ebf8c11b_JaffaCakes118.exe	97

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1636	eab193344b506b1507675779ebf8c11b_JaffaCakes118.exe
1636	eab193344b506b1507675779ebf8c11b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 1636	508	eab193344b506b1507675779ebf8c11b_JaffaCakes118.exe	97
PID 508 wrote to memory of 1636	508	eab193344b506b1507675779ebf8c11b_JaffaCakes118.exe	97
PID 508 wrote to memory of 1636	508	eab193344b506b1507675779ebf8c11b_JaffaCakes118.exe	97
PID 508 wrote to memory of 1636	508	eab193344b506b1507675779ebf8c11b_JaffaCakes118.exe	97
PID 508 wrote to memory of 1636	508	eab193344b506b1507675779ebf8c11b_JaffaCakes118.exe	97
PID 508 wrote to memory of 1636	508	eab193344b506b1507675779ebf8c11b_JaffaCakes118.exe	97

C:\Users\Admin\AppData\Local\Temp\eab193344b506b1507675779ebf8c11b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eab193344b506b1507675779ebf8c11b_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:508
- C:\Users\Admin\AppData\Local\Temp\eab193344b506b1507675779ebf8c11b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\eab193344b506b1507675779ebf8c11b_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/508-8-0x0000000005CA0000-0x0000000005CB2000-memory.dmp

Filesize
72KB

Download
memory/508-4-0x00000000057C0000-0x0000000005852000-memory.dmp

Filesize
584KB

Download
memory/508-1-0x0000000074D60000-0x0000000075510000-memory.dmp

Filesize
7.7MB

Download
memory/508-3-0x0000000005D70000-0x0000000006314000-memory.dmp

Filesize
5.6MB

Download
memory/508-9-0x0000000074D60000-0x0000000075510000-memory.dmp

Filesize
7.7MB

Download
memory/508-5-0x00000000059A0000-0x00000000059B0000-memory.dmp

Filesize
64KB

Download
memory/508-6-0x0000000005700000-0x000000000570A000-memory.dmp

Filesize
40KB

Download
memory/508-10-0x00000000059A0000-0x00000000059B0000-memory.dmp

Filesize
64KB

Download
memory/508-2-0x0000000005720000-0x00000000057BC000-memory.dmp

Filesize
624KB

Download
memory/508-0-0x0000000000C80000-0x0000000000D4E000-memory.dmp

Filesize
824KB

Download
memory/508-7-0x00000000058C0000-0x0000000005916000-memory.dmp

Filesize
344KB

Download
memory/508-11-0x00000000073C0000-0x0000000007460000-memory.dmp

Filesize
640KB

Download
memory/508-12-0x0000000005110000-0x0000000005140000-memory.dmp

Filesize
192KB

Download
memory/508-15-0x0000000074D60000-0x0000000075510000-memory.dmp

Filesize
7.7MB

Download
memory/1636-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1636-16-0x00000000012B0000-0x00000000015FA000-memory.dmp

Filesize
3.3MB

Download
memory/1636-17-0x00000000012B0000-0x00000000015FA000-memory.dmp

Filesize
3.3MB

Download