xloader | f6f805093e3fcd072baf272acaa57da57ac20f7e686414a866e215817f4062e8

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe
Size

704KB
MD5

f57bb0fe028ef8153ef5f35f49bc4814
SHA1

6097194ce764014cbc95fe96a1b4e2acccd33ab4
SHA256

f6f805093e3fcd072baf272acaa57da57ac20f7e686414a866e215817f4062e8
SHA512

30e2cbdf3628808c5425607bff5abe3888fc4925dd062a3b711ecf45e4424fc1f977ae5336d31c8209e2c979fffca71285643e7a1c3954ee403816fb643163de
SSDEEP

12288:QhJPU97PU9mso3htgYHOsBgo0q4wMsKwgPW1jPFmkxMeFk3orpXd7mPnjC6dvbWC:QhdYHOsBgo0q4wMsTgORgCMEmSXd7mmh

Score

10^/10

xloader p086 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

p086

Decoy

jinshichain.com

worldpettraveler.com

hightecforpc.com

kj97fm.com

streetnewstv.com

webrew.club

wheretogodubai.com

apostapolitica.net

thecafy.com

vinelosangeles.com

gashinc.com

gutitout.net

bvd-invest.com

realtoroutdesk.com

lawnbowlstournaments.net

nobodyisillegal.com

abogadoorihuela.net

sanistela.com

jksecurityworld.com

peppermintproject.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral2/memory/4172-7-0x00000000050D0000-0x00000000050E2000-memory.dmp	CustAttr

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1720-12-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4172 set thread context of 1720	4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe	85

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe
4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe
4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe
4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe
1720	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe
1720	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 4436	4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe	83
PID 4172 wrote to memory of 4436	4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe	83
PID 4172 wrote to memory of 4436	4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe	83
PID 4172 wrote to memory of 4448	4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe	84
PID 4172 wrote to memory of 4448	4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe	84
PID 4172 wrote to memory of 4448	4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe	84
PID 4172 wrote to memory of 1720	4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe	85
PID 4172 wrote to memory of 1720	4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe	85
PID 4172 wrote to memory of 1720	4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe	85
PID 4172 wrote to memory of 1720	4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe	85
PID 4172 wrote to memory of 1720	4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe	85
PID 4172 wrote to memory of 1720	4172	f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Users\Admin\AppData\Local\Temp\f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe"
  2⤵
  PID:4436
- C:\Users\Admin\AppData\Local\Temp\f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe"
  2⤵
  PID:4448
- C:\Users\Admin\AppData\Local\Temp\f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f57bb0fe028ef8153ef5f35f49bc4814_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-16-0x0000000001810000-0x0000000001B5A000-memory.dmp

Filesize
3.3MB

Download
memory/1720-15-0x0000000001810000-0x0000000001B5A000-memory.dmp

Filesize
3.3MB

Download
memory/4172-4-0x00000000057C0000-0x000000000585C000-memory.dmp

Filesize
624KB

Download
memory/4172-0-0x0000000074B30000-0x00000000752E0000-memory.dmp

Filesize
7.7MB

Download
memory/4172-5-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/4172-6-0x00000000056C0000-0x00000000056CA000-memory.dmp

Filesize
40KB

Download
memory/4172-7-0x00000000050D0000-0x00000000050E2000-memory.dmp

Filesize
72KB

Download
memory/4172-8-0x0000000074B30000-0x00000000752E0000-memory.dmp

Filesize
7.7MB

Download
memory/4172-9-0x0000000005690000-0x00000000056A0000-memory.dmp

Filesize
64KB

Download
memory/4172-10-0x00000000072E0000-0x000000000735C000-memory.dmp

Filesize
496KB

Download
memory/4172-11-0x0000000007360000-0x0000000007394000-memory.dmp

Filesize
208KB

Download
memory/4172-3-0x0000000005720000-0x00000000057B2000-memory.dmp

Filesize
584KB

Download
memory/4172-14-0x0000000074B30000-0x00000000752E0000-memory.dmp

Filesize
7.7MB

Download
memory/4172-2-0x0000000005CD0000-0x0000000006274000-memory.dmp

Filesize
5.6MB

Download
memory/4172-1-0x0000000000C50000-0x0000000000D06000-memory.dmp

Filesize
728KB

Download