Analysis
- max time kernel
147s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
16/04/2024, 01:41
General
- Target f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe
- Size 1.1MB
- Sample240416-b4actaga9w
- SHA256 a580a0ff9f6c6a6120632d565e69978de243842368c34c3f2abb3de3f441e06b
Malware Config
Extracted
-
xloader
-
2.3
-
p596
-
ushistorical.com
-
lovepropertylondon.com
-
acupress-the-point.com
-
3772548.com
-
ambientabuse.com
-
primaveracm.com
-
themidwestmomblog.com
-
havasavunma.com
-
rockyroadbrand.com
-
zzphys.com
-
masque-inclusif.com
-
myeonyeokplus.com
-
linkernet.pro
-
zezirma.com
-
mysiniar.com
-
andreamall.com
-
mattesonauto.com
-
wandopowerinc.com
-
casaurgence.com
-
salishseaquilts.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1732-6-0x0000000005560000-0x00000000055FC000-memory.dmp
memory/1732-10-0x0000000006250000-0x00000000062EA000-memory.dmp
memory/1732-2-0x0000000005760000-0x0000000005D04000-memory.dmp
memory/1732-3-0x0000000005250000-0x00000000052E2000-memory.dmp
memory/1732-4-0x00000000053C0000-0x00000000053D0000-memory.dmp
memory/1732-5-0x0000000005240000-0x000000000524A000-memory.dmp
memory/1732-1-0x0000000000750000-0x0000000000874000-memory.dmp
memory/1732-8-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/1732-0-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/1732-9-0x00000000053C0000-0x00000000053D0000-memory.dmp
memory/1732-7-0x0000000005340000-0x0000000005352000-memory.dmp
memory/1732-11-0x00000000086B0000-0x00000000086DE000-memory.dmp
memory/1732-14-0x0000000074FF0000-0x00000000757A0000-memory.dmp
memory/4564-12-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4564-15-0x0000000001910000-0x0000000001C5A000-memory.dmp