xloader | 52f806c63abcb56facb2b2e12e9df8b142a08d9f35d55923f68cf9681cbdd7cf

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe
Size

224KB
MD5

f5e8a440c4d1c017b4a8dfc2bed4608f
SHA1

5d2b844eeadae6958d46b02ab2615e174b58dbbe
SHA256

52f806c63abcb56facb2b2e12e9df8b142a08d9f35d55923f68cf9681cbdd7cf
SHA512

bd992f4268151bebf01777036d556815357a1e90280206d24b1dc51a400dd45c8336502ba40cddb3bbf3c44f06327fc4e390faa67adc54f62c881c2c3d555d17
SSDEEP

3072:ArSthTTTTTTTTTTTTTbeOB2f1Gb6l3bVMSgu2jmnd1CqsSL/omlT5uhCRKRe4TBo:gcVemEX0SgBmeq1wmqh7MxNKJcNnmW

Score

10^/10

xloader p086 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

p086

Decoy

jinshichain.com

worldpettraveler.com

hightecforpc.com

kj97fm.com

streetnewstv.com

webrew.club

wheretogodubai.com

apostapolitica.net

thecafy.com

vinelosangeles.com

gashinc.com

gutitout.net

bvd-invest.com

realtoroutdesk.com

lawnbowlstournaments.net

nobodyisillegal.com

abogadoorihuela.net

sanistela.com

jksecurityworld.com

peppermintproject.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/3040-3-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe

description	pid	process	target process
PID 1148 set thread context of 3040	1148	f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe	f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe

pid process

3040 f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe

pid process

1148 f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe

pid	process
3040	f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe

pid	process
1148	f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe

description	pid	process	target process
PID 1148 wrote to memory of 3040	1148	f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe	f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe
PID 1148 wrote to memory of 3040	1148	f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe	f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe
PID 1148 wrote to memory of 3040	1148	f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe	f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe
PID 1148 wrote to memory of 3040	1148	f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe	f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe
PID 1148 wrote to memory of 3040	1148	f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe	f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1148

C:\Users\Admin\AppData\Local\Temp\f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5e8a440c4d1c017b4a8dfc2bed4608f_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3040

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1148-1-0x0000000000340000-0x0000000000440000-memory.dmp

Filesize
1024KB

Download
memory/1148-2-0x0000000000140000-0x0000000000142000-memory.dmp

Filesize
8KB

Download
memory/3040-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3040-4-0x0000000000970000-0x0000000000C73000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads