xloader | 7384a61fc69ce24610f7c4658c2ef8786c4cdc5d6ad6b33d1a9f506d6b6388d3

General

Target

efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe
Size

660KB
MD5

efb464ece5f5aa332a60d241aa93a74f
SHA1

1b07ef42b7d91b71600f7512e6eb7248510b2330
SHA256

7384a61fc69ce24610f7c4658c2ef8786c4cdc5d6ad6b33d1a9f506d6b6388d3
SHA512

86c4b630151a648ed004e543996eba2d9a54dfb14de71b1f38f2e4fe4881c4e2a8b7e2c7f6c52876d8f3eb4406b0c12c349861e024de40568306b3505bd3ef82
SSDEEP

6144:h8LxB/WPFi3n+dwNOOGAmuDkM+fcA3RNNJzYTwXF0WmZfml7WcXg6tFI:vCNOUHkMgc8zN0Wmhs7kj

Score

10^/10

xloader ons6 loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ons6

Decoy

946acc.net

ilkermulla.com

edificationhub.com

aptbaby.com

luisrgonzalez.com

postandpine.com

objective-object.com

storeydrive.rentals

mobile-find.com

africanbridaluk.com

zzjn12.xyz

ritechoiceinvestmentgroup.com

zitzies.xyz

trulyproofreading.com

ktndetermine.xyz

advertising.land

keywordgomuwk.xyz

niecliomusicspirit.com

lhortelecom.com

cryptochieftan.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2060-9-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 2 IoCs

Processes:

efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exeWerFault.exe

pid process

2276 efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe
2772 WerFault.exe

pid	process
2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe
2772	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe

description	pid	process	target process
PID 2276 set thread context of 2060	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2772 2276 WerFault.exe efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe

pid process

2060 efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe

pid	pid_target	process	target process
2772	2276	WerFault.exe	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe

pid	process
2060	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe

description	pid	process	target process
PID 2276 wrote to memory of 2060	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe
PID 2276 wrote to memory of 2060	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe
PID 2276 wrote to memory of 2060	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe
PID 2276 wrote to memory of 2060	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe
PID 2276 wrote to memory of 2060	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe
PID 2276 wrote to memory of 2060	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe
PID 2276 wrote to memory of 2060	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe
PID 2276 wrote to memory of 2772	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	WerFault.exe
PID 2276 wrote to memory of 2772	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	WerFault.exe
PID 2276 wrote to memory of 2772	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	WerFault.exe
PID 2276 wrote to memory of 2772	2276	efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2276

C:\Users\Admin\AppData\Local\Temp\efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\efb464ece5f5aa332a60d241aa93a74f_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 492
2⤵
- Loads dropped DLL
- Program crash
PID:2772

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nst199A.tmp\rzvd.dll
Filesize
27KB

MD5
d255169c5e130e0104b01f2ceb04c885

SHA1
e9a0bf4c711f63829fb077b75b57a14b6bdda4bc

SHA256
66c07a5eb743d77deff8b16a8cbcc1be0795df5197874f23fd440fbf0cae38a8

SHA512
15f54c5f3de381c4b935886bd120d1e4ab609109015b6b49b842aa34b465467706ac79e0b8ad0961046e841e8e352df2a12b70653c960115e6ff92c4b282605e

Download Submit
memory/2060-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2060-12-0x00000000008A0000-0x0000000000BA3000-memory.dmp

Filesize
3.0MB

Download
memory/2276-7-0x0000000074AC0000-0x0000000074ACA000-memory.dmp

Filesize
40KB

Download
memory/2276-14-0x0000000074AC0000-0x0000000074ACA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads