xloader | 94ec59e8f70de9f2fc9a4774fc7ed32a7a0495115a813537f77c9aeb505a5bc4

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5e06eac210ad2965522d958281c8c95_JaffaCakes118.exe
Size

733KB
MD5

f5e06eac210ad2965522d958281c8c95
SHA1

102aa3b2f0a0f032fd4f830095617674be963525
SHA256

94ec59e8f70de9f2fc9a4774fc7ed32a7a0495115a813537f77c9aeb505a5bc4
SHA512

3e7657b45fdd015d966c78e17af01cf204a6886b951cb66960effbf8b35dec2e5927eb88f71cd272d27ce8e1f7ab9949293ecf0091747b9ba9a4970a33cdce91
SSDEEP

12288:yX2fYp/cCOsBgo0q4wMRYSyKDpbeE9/fJT8c0TXH/wOKviT:yX2fzCOsBgo0q4wMRYzKFHHJTwrHrj

Score

10^/10

xloader wufn loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

wufn

Decoy

rsautoluxe.com

theroseofsharonsalon.com

singnema.com

nathanielwhite108.com

theforumonline.com

iqpt.info

joneshondaservice.com

fafene.com

solanohomebuyerclass.com

zwq.xyz

searchlakeconroehomes.com

briative.com

frystmor.city

systemofyouth.com

sctsmney.com

tv-safetrading.com

thesweetboy.com

occulusblu.com

pawsthemomentpetphotography.com

travelstipsguide.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral1/memory/2052-3-0x0000000000530000-0x0000000000542000-memory.dmp	CustAttr

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2452-13-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2052 set thread context of 2452	2052	f5e06eac210ad2965522d958281c8c95_JaffaCakes118.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2452	f5e06eac210ad2965522d958281c8c95_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2452	2052	f5e06eac210ad2965522d958281c8c95_JaffaCakes118.exe	30
PID 2052 wrote to memory of 2452	2052	f5e06eac210ad2965522d958281c8c95_JaffaCakes118.exe	30
PID 2052 wrote to memory of 2452	2052	f5e06eac210ad2965522d958281c8c95_JaffaCakes118.exe	30
PID 2052 wrote to memory of 2452	2052	f5e06eac210ad2965522d958281c8c95_JaffaCakes118.exe	30
PID 2052 wrote to memory of 2452	2052	f5e06eac210ad2965522d958281c8c95_JaffaCakes118.exe	30
PID 2052 wrote to memory of 2452	2052	f5e06eac210ad2965522d958281c8c95_JaffaCakes118.exe	30
PID 2052 wrote to memory of 2452	2052	f5e06eac210ad2965522d958281c8c95_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\f5e06eac210ad2965522d958281c8c95_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5e06eac210ad2965522d958281c8c95_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Users\Admin\AppData\Local\Temp\f5e06eac210ad2965522d958281c8c95_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f5e06eac210ad2965522d958281c8c95_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2052-6-0x0000000004140000-0x0000000004172000-memory.dmp

Filesize
200KB

Download
memory/2052-1-0x0000000000BC0000-0x0000000000C7E000-memory.dmp

Filesize
760KB

Download
memory/2052-2-0x0000000004180000-0x00000000041C0000-memory.dmp

Filesize
256KB

Download
memory/2052-3-0x0000000000530000-0x0000000000542000-memory.dmp

Filesize
72KB

Download
memory/2052-4-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2052-5-0x0000000005A60000-0x0000000005ADA000-memory.dmp

Filesize
488KB

Download
memory/2052-0-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2052-14-0x0000000074840000-0x0000000074F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2452-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2452-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2452-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2452-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2452-15-0x0000000000C80000-0x0000000000F83000-memory.dmp

Filesize
3.0MB

Download