xloader | 7a34064785bd677a927fa90988d9001aed285762f230d0fe08db7b2ca89ce987

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe
Size

252KB
MD5

f02f2961032796a25c7e090bb4f70566
SHA1

8c530a1533800db7d8dea165ea93421e2c996dad
SHA256

7a34064785bd677a927fa90988d9001aed285762f230d0fe08db7b2ca89ce987
SHA512

92df5ef56be6a6f5eeaeeb9b11559ca0a2960de9e7e0ba3a24308d603fa7be3375e41f7a618b6d02a4d7739b3ac75ba91203bf2ecfe963689539bc05dcdb0507
SSDEEP

6144:Ld53TvpHeIl0l7o0YJvxPfqAg2bwejuDjwZbC9sU7ltYp9f7OANxB:Ld53TvpHeIl0l7ohBv0fAbCHTyqA

Score

10^/10

xloader dzqd loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

dzqd

Decoy

weekendsday.com

kansasfriedchiken.com

bestselfdrive.com

timeleveragechallenge.com

theunboxiblenation.net

adriaeurope-group.com

acrylicphotobloc.com

theincentivized.com

histreetbutler.com

kumamkt.com

cutepuppyspot.store

crisp-ui.com

easyecotour.com

longshotloungeenglewood.com

esotericclothingco.com

henglai58.com

handmadecircles.com

k9itsrk940aeq6.xyz

service-it-net.com

rt-p-c-14h9-1elk-jpzs.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1524-3-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 1524	1640	f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1524	f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1640	f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1524	1640	f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1524	1640	f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1524	1640	f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1524	1640	f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe	28
PID 1640 wrote to memory of 1524	1640	f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1524-4-0x0000000000840000-0x0000000000B43000-memory.dmp

Filesize
3.0MB

Download
memory/1640-1-0x0000000000090000-0x0000000000190000-memory.dmp

Filesize
1024KB

Download
memory/1640-2-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download