xloader | e91d88bbb3693136fce60e4208200af50f9855a1d4b4e96d164ba7ef8b1e0bda

General

Target

ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe
Size

1.6MB
MD5

ef3ee1a764a33632b5cf8d0b10853d8d
SHA1

815dde75d76b1f61ac69cff8edfebed265aa801f
SHA256

e91d88bbb3693136fce60e4208200af50f9855a1d4b4e96d164ba7ef8b1e0bda
SHA512

abdda3497ceaba4b2b8513fa5344fc4aa631858c26f9b32fc7f10d0d2971b935859acd27d54845cc4c11a8fc7a920d9d52ac21194ef05e125fdd09cedc8246f0
SSDEEP

24576:nqLS/d3UYdkb7Mb+8w/qx/YNTSlzPdVsC9+8EUUWbmwRGPoN7vdiTbnFM:NM7Mb+8P/xtUeLEcm/PoiM

Score

10^/10

xloader r58u loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

r58u

Decoy

schmidt-montecarmelo.com

bainrix.com

healtracer.com

thriveclothingclub.com

thedreamforce.computer

cbidhh.icu

btcmart.info

nnghxks75.com

524joshua.com

novarealty.homes

a2amc.com

ebtbedge.com

youmaitiantian.com

bjhszz.com

dwchongzhi.com

getfastpage.com

customerservice-netflix.com

pontiac.today

tved-rnzfr.xyz

flourishingfamilies.today

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral2/memory/2584-8-0x0000000005D10000-0x0000000005D22000-memory.dmp	CustAttr

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4284-18-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe

description	pid	process	target process
PID 2584 set thread context of 4284	2584	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1244 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe

pid process

4284 ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe
4284 ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe

pid	process
1244	schtasks.exe

pid	process
4284	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe
4284	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe

description	pid	process	target process
PID 2584 wrote to memory of 1244	2584	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	schtasks.exe
PID 2584 wrote to memory of 1244	2584	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	schtasks.exe
PID 2584 wrote to memory of 1244	2584	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	schtasks.exe
PID 2584 wrote to memory of 4284	2584	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe
PID 2584 wrote to memory of 4284	2584	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe
PID 2584 wrote to memory of 4284	2584	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe
PID 2584 wrote to memory of 4284	2584	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe
PID 2584 wrote to memory of 4284	2584	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe
PID 2584 wrote to memory of 4284	2584	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe	ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2584

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IPUhzTin" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA081.tmp"
2⤵
- Creates scheduled task(s)
PID:1244

C:\Users\Admin\AppData\Local\Temp\ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef3ee1a764a33632b5cf8d0b10853d8d_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:3604

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA081.tmp
Filesize
1KB

MD5
fc486392f78f648eea0638e02c131276

SHA1
2d5e0131b634beead2ab40404e4c864ea1d6eb8c

SHA256
a60977cd4332391b22720384dd8b160d320fe7b825f7bebd8d85880eb5888b03

SHA512
e57deaa08142cc22038bd44f632607ffffc610a5ea1f0ca0adaa26942aa188cb8b85a0abc494e71e461d07662a24039c00f4aac00868c0512e66abe33e14d712

Download Submit
memory/2584-8-0x0000000005D10000-0x0000000005D22000-memory.dmp

Filesize
72KB

Download
memory/2584-7-0x0000000005C00000-0x0000000005C56000-memory.dmp

Filesize
344KB

Download
memory/2584-3-0x0000000005FB0000-0x0000000006554000-memory.dmp

Filesize
5.6MB

Download
memory/2584-4-0x0000000005A00000-0x0000000005A92000-memory.dmp

Filesize
584KB

Download
memory/2584-9-0x0000000074F30000-0x00000000756E0000-memory.dmp

Filesize
7.7MB

Download
memory/2584-6-0x0000000005950000-0x000000000595A000-memory.dmp

Filesize
40KB

Download
memory/2584-2-0x0000000005960000-0x00000000059FC000-memory.dmp

Filesize
624KB

Download
memory/2584-0-0x0000000074F30000-0x00000000756E0000-memory.dmp

Filesize
7.7MB

Download
memory/2584-5-0x0000000005BF0000-0x0000000005C00000-memory.dmp

Filesize
64KB

Download
memory/2584-10-0x0000000005BF0000-0x0000000005C00000-memory.dmp

Filesize
64KB

Download
memory/2584-11-0x00000000076D0000-0x000000000776E000-memory.dmp

Filesize
632KB

Download
memory/2584-12-0x0000000007370000-0x000000000739E000-memory.dmp

Filesize
184KB

Download
memory/2584-1-0x0000000000DF0000-0x0000000000F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2584-20-0x0000000074F30000-0x00000000756E0000-memory.dmp

Filesize
7.7MB

Download
memory/4284-18-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4284-21-0x0000000000F40000-0x000000000128A000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads