xloader | e91d88bbb3693136fce60e4208200af50f9855a1d4b4e96d164ba7ef8b1e0bda

General

Target

ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe
Size

1.6MB
MD5

ef3ee1a764a33632b5cf8d0b10853d8d
SHA1

815dde75d76b1f61ac69cff8edfebed265aa801f
SHA256

e91d88bbb3693136fce60e4208200af50f9855a1d4b4e96d164ba7ef8b1e0bda
SHA512

abdda3497ceaba4b2b8513fa5344fc4aa631858c26f9b32fc7f10d0d2971b935859acd27d54845cc4c11a8fc7a920d9d52ac21194ef05e125fdd09cedc8246f0
SSDEEP

24576:nqLS/d3UYdkb7Mb+8w/qx/YNTSlzPdVsC9+8EUUWbmwRGPoN7vdiTbnFM:NM7Mb+8P/xtUeLEcm/PoiM

Score

10^/10

xloader r58u loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

r58u

Decoy

schmidt-montecarmelo.com

bainrix.com

healtracer.com

thriveclothingclub.com

thedreamforce.computer

cbidhh.icu

btcmart.info

nnghxks75.com

524joshua.com

novarealty.homes

a2amc.com

ebtbedge.com

youmaitiantian.com

bjhszz.com

dwchongzhi.com

getfastpage.com

customerservice-netflix.com

pontiac.today

tved-rnzfr.xyz

flourishingfamilies.today

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral1/memory/2892-3-0x0000000000350000-0x0000000000362000-memory.dmp	CustAttr

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2912-17-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2892 set thread context of 2912	2892	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2912	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2384	2892	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	30
PID 2892 wrote to memory of 2384	2892	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	30
PID 2892 wrote to memory of 2384	2892	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	30
PID 2892 wrote to memory of 2384	2892	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	30
PID 2892 wrote to memory of 2912	2892	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	32
PID 2892 wrote to memory of 2912	2892	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	32
PID 2892 wrote to memory of 2912	2892	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	32
PID 2892 wrote to memory of 2912	2892	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	32
PID 2892 wrote to memory of 2912	2892	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	32
PID 2892 wrote to memory of 2912	2892	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	32
PID 2892 wrote to memory of 2912	2892	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	32

C:\Users\Admin\AppData\Local\Temp\ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IPUhzTin" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4AE5.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2384
- C:\Users\Admin\AppData\Local\Temp\ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4AE5.tmp

Filesize
1KB

MD5
117cce340db082a508c884cc5f02c7b0

SHA1
5dafa6d5344c38f70db5aa487bdc00d54fa270fa

SHA256
04a213ee86c988ad4a7fa9a4bc64b57d2633bb365ec01821cd9bd72c790e952f

SHA512
8e73c8ec0b2945f219738dd62f15fe878f1009aa3f43c8333c2b83091f169c4f40b81e184fefc7ff66f00182c32b10099d80c6b60853437da29cf7a9fb4cd966

Download Submit
memory/2892-6-0x0000000005800000-0x000000000589E000-memory.dmp

Filesize
632KB

Download
memory/2892-1-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2892-3-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2892-4-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2892-5-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/2892-2-0x0000000004E40000-0x0000000004E80000-memory.dmp

Filesize
256KB

Download
memory/2892-7-0x0000000000530000-0x000000000055E000-memory.dmp

Filesize
184KB

Download
memory/2892-0-0x0000000000DC0000-0x0000000000F5E000-memory.dmp

Filesize
1.6MB

Download
memory/2892-18-0x0000000074340000-0x0000000074A2E000-memory.dmp

Filesize
6.9MB

Download
memory/2912-14-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2912-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2912-17-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2912-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2912-19-0x0000000000860000-0x0000000000B63000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads