xloader | 2ab54e46be8e8a1b7e66be9bed5492e2cb5c4112e548442e209954affc2dc374

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe
Size

229KB
MD5

f4689766d507f4eb2f206cf8ea3e237d
SHA1

d85b7cf1d1544fb02c50f0ae8fdf24e85adb86b5
SHA256

2ab54e46be8e8a1b7e66be9bed5492e2cb5c4112e548442e209954affc2dc374
SHA512

606a0e1e61f15785d1f8e411795b11c0e8d20c889a6fdc6c2db445f7e24c9ac8ef50773f91ec76d21ff0b692c208831153254035af947374ec4034d33a50c53e
SSDEEP

6144:JwX/EDsssssssssssssvxx02JKflFxLav6qGJyogGzssG5O5POJKf:J4/EDsssssssssssssJ7YtF9eGO6ssGa

Score

10^/10

xloader b6cu loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

b6cu

Decoy

votreconseilfinancier.com

wholesaleplay.com

komfy.store

hsyunfan.com

tournamenttips.com

yourbusine.xyz

wrg-referrals.com

harmless-oily.com

whizdomtowealth.com

xusmods.com

cleanerstoday.com

finopscert.com

paerexpress.com

kankb.com

res-o.info

balonpantolon.com

freedownloadbiz.info

jeffegriffin.com

gobahis119.com

ourcalvinsarm.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2164-2-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe

description	pid	process	target process
PID 2256 set thread context of 2164	2256	f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe	f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe

pid process

2164 f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe

pid process

2256 f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe

pid	process
2164	f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe

pid	process
2256	f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe

description	pid	process	target process
PID 2256 wrote to memory of 2164	2256	f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe	f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe
PID 2256 wrote to memory of 2164	2256	f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe	f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe
PID 2256 wrote to memory of 2164	2256	f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe	f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe
PID 2256 wrote to memory of 2164	2256	f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe	f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe
PID 2256 wrote to memory of 2164	2256	f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe	f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2256

C:\Users\Admin\AppData\Local\Temp\f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f4689766d507f4eb2f206cf8ea3e237d_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2164

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2164-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2164-3-0x0000000000840000-0x0000000000B43000-memory.dmp

Filesize
3.0MB

Download
memory/2256-0-0x0000000000C60000-0x0000000000C67000-memory.dmp

Filesize
28KB

Download
memory/2256-1-0x0000000000140000-0x0000000000142000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads