xloader | a580a0ff9f6c6a6120632d565e69978de243842368c34c3f2abb3de3f441e06b

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe
Size

1.1MB
MD5

f2654cd7598c850ba9229ce85998b556
SHA1

6108ca584686f895fe949878af699e846cbe19d0
SHA256

a580a0ff9f6c6a6120632d565e69978de243842368c34c3f2abb3de3f441e06b
SHA512

d911bab4267a5ff0907f09e5fe4a3c22e18452659e0af17bc9dc719ba5fb27e2863429cf28debe11597209c15cb22a4c7226310f5dd2ff2984030e91fa7051c0
SSDEEP

24576:odS/d31Kzks8ks21oODt9HJcPNoPZBUK3ITy8jh8N6ZN:JKDBxfQK30ON6ZN

Score

10^/10

xloader p596 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

p596

Decoy

ushistorical.com

lovepropertylondon.com

acupress-the-point.com

3772548.com

ambientabuse.com

primaveracm.com

themidwestmomblog.com

havasavunma.com

rockyroadbrand.com

zzphys.com

masque-inclusif.com

myeonyeokplus.com

linkernet.pro

zezirma.com

mysiniar.com

andreamall.com

mattesonauto.com

wandopowerinc.com

casaurgence.com

salishseaquilts.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

Processes:

resource	yara_rule
behavioral2/memory/1732-7-0x0000000005340000-0x0000000005352000-memory.dmp	CustAttr

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4564-12-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe

description	pid	process	target process
PID 1732 set thread context of 4564	1732	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exef2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe

pid	process
1732	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe
4564	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe
4564	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 1732 f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	1732	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe

description	pid	process	target process
PID 1732 wrote to memory of 4564	1732	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe
PID 1732 wrote to memory of 4564	1732	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe
PID 1732 wrote to memory of 4564	1732	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe
PID 1732 wrote to memory of 4564	1732	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe
PID 1732 wrote to memory of 4564	1732	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe
PID 1732 wrote to memory of 4564	1732	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe	f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732

C:\Users\Admin\AppData\Local\Temp\f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f2654cd7598c850ba9229ce85998b556_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1732-6-0x0000000005560000-0x00000000055FC000-memory.dmp

Filesize
624KB

Download
memory/1732-8-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Filesize
7.7MB

Download
memory/1732-2-0x0000000005760000-0x0000000005D04000-memory.dmp

Filesize
5.6MB

Download
memory/1732-3-0x0000000005250000-0x00000000052E2000-memory.dmp

Filesize
584KB

Download
memory/1732-4-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/1732-5-0x0000000005240000-0x000000000524A000-memory.dmp

Filesize
40KB

Download
memory/1732-1-0x0000000000750000-0x0000000000874000-memory.dmp

Filesize
1.1MB

Download
memory/1732-7-0x0000000005340000-0x0000000005352000-memory.dmp

Filesize
72KB

Download
memory/1732-0-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Filesize
7.7MB

Download
memory/1732-9-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/1732-10-0x0000000006250000-0x00000000062EA000-memory.dmp

Filesize
616KB

Download
memory/1732-11-0x00000000086B0000-0x00000000086DE000-memory.dmp

Filesize
184KB

Download
memory/1732-14-0x0000000074FF0000-0x00000000757A0000-memory.dmp

Filesize
7.7MB

Download
memory/4564-12-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4564-15-0x0000000001910000-0x0000000001C5A000-memory.dmp

Filesize
3.3MB

Download