xloader | fc0e2a9e079a5b4e655a9df1c5ffff7d9a75253b67e19de4f6493cac7f1cc8de

General

Target

ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe
Size

1.1MB
MD5

ef8a8ee5715950972a071606db42faf7
SHA1

0377d2e9eb57b8896694208c093d229b7819adda
SHA256

fc0e2a9e079a5b4e655a9df1c5ffff7d9a75253b67e19de4f6493cac7f1cc8de
SHA512

cc6a21a532becec572d9a667aad3fa223a8298c6f47581ef448c69af2920db6d9fae260844271a681f00469f196488a799943818a6821c4ec9b0e3e4a2c58170
SSDEEP

12288:X8Dc9F3nC0Py3gAhowPAA8gdBaY1Tn43UXW05r7SATsr2f6E4zcI+j4hwIP5USnf:XYPAAKYVRt7Hft4zcf4ge3

Score

10^/10

xloader m6t2 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

m6t2

Decoy

online-profile-verify.com

moderngypsydesignlabs.com

aptecnologiagricola.com

caprevenue.com

arcadems.com

feedbackresearchinstitute.net

shivbodhi.com

mesaglobalindustries.com

trumphonduras.com

ifwebecomeportland.info

toluar.com

thegreatoutdoor.store

tipp24.online

penyaluranpuk08.net

sheliaddesigns.com

robpaulmessage17.com

santacruzlist.com

reiki4me.com

856380512.xyz

systemsreform.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3544-12-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe

description	pid	process	target process
PID 1884 set thread context of 3544	1884	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exepowershell.exe

pid	process
3544	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe
3544	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe
2912	powershell.exe
2912	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2912 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2912	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe

description	pid	process	target process
PID 1884 wrote to memory of 2912	1884	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe	powershell.exe
PID 1884 wrote to memory of 2912	1884	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe	powershell.exe
PID 1884 wrote to memory of 2912	1884	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe	powershell.exe
PID 1884 wrote to memory of 3544	1884	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe
PID 1884 wrote to memory of 3544	1884	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe
PID 1884 wrote to memory of 3544	1884	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe
PID 1884 wrote to memory of 3544	1884	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe
PID 1884 wrote to memory of 3544	1884	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe
PID 1884 wrote to memory of 3544	1884	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe	ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1884

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912

C:\Users\Admin\AppData\Local\Temp\ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef8a8ee5715950972a071606db42faf7_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3544

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ero1ystt.ig1.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1884-6-0x0000000005C90000-0x0000000005D2C000-memory.dmp

Filesize
624KB

Download
memory/1884-2-0x0000000005E70000-0x0000000006414000-memory.dmp

Filesize
5.6MB

Download
memory/1884-3-0x00000000058C0000-0x0000000005952000-memory.dmp

Filesize
584KB

Download
memory/1884-4-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

Filesize
64KB

Download
memory/1884-5-0x0000000005860000-0x000000000586A000-memory.dmp

Filesize
40KB

Download
memory/1884-0-0x0000000000D80000-0x0000000000E96000-memory.dmp

Filesize
1.1MB

Download
memory/1884-7-0x0000000005890000-0x00000000058A8000-memory.dmp

Filesize
96KB

Download
memory/1884-8-0x0000000074480000-0x0000000074C30000-memory.dmp

Filesize
7.7MB

Download
memory/1884-9-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

Filesize
64KB

Download
memory/1884-10-0x00000000068C0000-0x0000000006972000-memory.dmp

Filesize
712KB

Download
memory/1884-11-0x0000000008E50000-0x0000000008E92000-memory.dmp

Filesize
264KB

Download
memory/1884-1-0x0000000074480000-0x0000000074C30000-memory.dmp

Filesize
7.7MB

Download
memory/1884-14-0x0000000074480000-0x0000000074C30000-memory.dmp

Filesize
7.7MB

Download
memory/2912-21-0x0000000005240000-0x0000000005262000-memory.dmp

Filesize
136KB

Download
memory/2912-36-0x000000007EEC0000-0x000000007EED0000-memory.dmp

Filesize
64KB

Download
memory/2912-16-0x0000000004C30000-0x0000000004C66000-memory.dmp

Filesize
216KB

Download
memory/2912-18-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/2912-19-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/2912-20-0x00000000053B0000-0x00000000059D8000-memory.dmp

Filesize
6.2MB

Download
memory/2912-61-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2912-22-0x0000000005A90000-0x0000000005AF6000-memory.dmp

Filesize
408KB

Download
memory/2912-28-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Filesize
408KB

Download
memory/2912-58-0x0000000007850000-0x0000000007858000-memory.dmp

Filesize
32KB

Download
memory/2912-33-0x0000000005D20000-0x0000000006074000-memory.dmp

Filesize
3.3MB

Download
memory/2912-34-0x0000000006200000-0x000000000621E000-memory.dmp

Filesize
120KB

Download
memory/2912-35-0x0000000006250000-0x000000000629C000-memory.dmp

Filesize
304KB

Download
memory/2912-17-0x0000000074500000-0x0000000074CB0000-memory.dmp

Filesize
7.7MB

Download
memory/2912-37-0x00000000067D0000-0x0000000006802000-memory.dmp

Filesize
200KB

Download
memory/2912-38-0x0000000070320000-0x000000007036C000-memory.dmp

Filesize
304KB

Download
memory/2912-48-0x0000000006810000-0x000000000682E000-memory.dmp

Filesize
120KB

Download
memory/2912-49-0x0000000007440000-0x00000000074E3000-memory.dmp

Filesize
652KB

Download
memory/2912-50-0x0000000007B70000-0x00000000081EA000-memory.dmp

Filesize
6.5MB

Download
memory/2912-51-0x0000000007530000-0x000000000754A000-memory.dmp

Filesize
104KB

Download
memory/2912-52-0x00000000075A0000-0x00000000075AA000-memory.dmp

Filesize
40KB

Download
memory/2912-53-0x00000000077B0000-0x0000000007846000-memory.dmp

Filesize
600KB

Download
memory/2912-54-0x0000000007730000-0x0000000007741000-memory.dmp

Filesize
68KB

Download
memory/2912-55-0x0000000007760000-0x000000000776E000-memory.dmp

Filesize
56KB

Download
memory/2912-56-0x0000000007770000-0x0000000007784000-memory.dmp

Filesize
80KB

Download
memory/2912-57-0x0000000007870000-0x000000000788A000-memory.dmp

Filesize
104KB

Download
memory/3544-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3544-15-0x0000000001930000-0x0000000001C7A000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads