xloader | 7384a61fc69ce24610f7c4658c2ef8786c4cdc5d6ad6b33d1a9f506d6b6388d3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-04-2024 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe
Size

660KB
MD5

efb464ece5f5aa332a60d241aa93a74f
SHA1

1b07ef42b7d91b71600f7512e6eb7248510b2330
SHA256

7384a61fc69ce24610f7c4658c2ef8786c4cdc5d6ad6b33d1a9f506d6b6388d3
SHA512

86c4b630151a648ed004e543996eba2d9a54dfb14de71b1f38f2e4fe4881c4e2a8b7e2c7f6c52876d8f3eb4406b0c12c349861e024de40568306b3505bd3ef82
SSDEEP

6144:h8LxB/WPFi3n+dwNOOGAmuDkM+fcA3RNNJzYTwXF0WmZfml7WcXg6tFI:vCNOUHkMgc8zN0Wmhs7kj

Score

10^/10

xloader ons6 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ons6

Decoy

946acc.net

ilkermulla.com

edificationhub.com

aptbaby.com

luisrgonzalez.com

postandpine.com

objective-object.com

storeydrive.rentals

mobile-find.com

africanbridaluk.com

zzjn12.xyz

ritechoiceinvestmentgroup.com

zitzies.xyz

trulyproofreading.com

ktndetermine.xyz

advertising.land

keywordgomuwk.xyz

niecliomusicspirit.com

lhortelecom.com

cryptochieftan.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2060-9-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 2 IoCs

pid	Process
2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe
2772	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2276 set thread context of 2060	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2772	2276	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2060	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2060	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	28
PID 2276 wrote to memory of 2060	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	28
PID 2276 wrote to memory of 2060	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	28
PID 2276 wrote to memory of 2060	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	28
PID 2276 wrote to memory of 2060	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	28
PID 2276 wrote to memory of 2060	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	28
PID 2276 wrote to memory of 2060	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	28
PID 2276 wrote to memory of 2772	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	29
PID 2276 wrote to memory of 2772	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	29
PID 2276 wrote to memory of 2772	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	29
PID 2276 wrote to memory of 2772	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Local\Temp\efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 492
  2⤵
  - Loads dropped DLL
  - Program crash
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst199A.tmp\rzvd.dll

Filesize
27KB

MD5
d255169c5e130e0104b01f2ceb04c885

SHA1
e9a0bf4c711f63829fb077b75b57a14b6bdda4bc

SHA256
66c07a5eb743d77deff8b16a8cbcc1be0795df5197874f23fd440fbf0cae38a8

SHA512
15f54c5f3de381c4b935886bd120d1e4ab609109015b6b49b842aa34b465467706ac79e0b8ad0961046e841e8e352df2a12b70653c960115e6ff92c4b282605e

Download Submit
memory/2060-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2060-12-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Filesize
3.0MB

Download
memory/2276-7-0x0000000074AC0000-0x0000000074ACA000-memory.dmp

Filesize
40KB

Download
memory/2276-14-0x0000000074AC0000-0x0000000074ACA000-memory.dmp

Filesize
40KB

Download