xloader | 7a34064785bd677a927fa90988d9001aed285762f230d0fe08db7b2ca89ce987

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe
Size

252KB
MD5

f02f2961032796a25c7e090bb4f70566
SHA1

8c530a1533800db7d8dea165ea93421e2c996dad
SHA256

7a34064785bd677a927fa90988d9001aed285762f230d0fe08db7b2ca89ce987
SHA512

92df5ef56be6a6f5eeaeeb9b11559ca0a2960de9e7e0ba3a24308d603fa7be3375e41f7a618b6d02a4d7739b3ac75ba91203bf2ecfe963689539bc05dcdb0507
SSDEEP

6144:Ld53TvpHeIl0l7o0YJvxPfqAg2bwejuDjwZbC9sU7ltYp9f7OANxB:Ld53TvpHeIl0l7ohBv0fAbCHTyqA

Score

10^/10

xloader dzqd loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

dzqd

Decoy

weekendsday.com

kansasfriedchiken.com

bestselfdrive.com

timeleveragechallenge.com

theunboxiblenation.net

adriaeurope-group.com

acrylicphotobloc.com

theincentivized.com

histreetbutler.com

kumamkt.com

cutepuppyspot.store

crisp-ui.com

easyecotour.com

longshotloungeenglewood.com

esotericclothingco.com

henglai58.com

handmadecircles.com

k9itsrk940aeq6.xyz

service-it-net.com

rt-p-c-14h9-1elk-jpzs.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2724-3-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3720 set thread context of 2724	3720	f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2724	f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe
2724	f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3720	f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 2724	3720	f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe	87
PID 3720 wrote to memory of 2724	3720	f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe	87
PID 3720 wrote to memory of 2724	3720	f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe	87
PID 3720 wrote to memory of 2724	3720	f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\AppData\Local\Temp\f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f02f2961032796a25c7e090bb4f70566_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2724-3-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2724-4-0x00000000009F0000-0x0000000000D3A000-memory.dmp

Filesize
3.3MB

Download
memory/3720-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

Filesize
1024KB

Download
memory/3720-2-0x0000000000A10000-0x0000000000A12000-memory.dmp

Filesize
8KB

Download