xloader | 4938b1c8ca1745b33ea6adc31b39e2003646370ec7f52fe1e89af6903a69aaca

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe
Size

224KB
MD5

f5fa2e043b901e50f0e6e8ad0e4f7074
SHA1

221c67c606a3a2e0c5bfa8b57d7c749e29b074d8
SHA256

4938b1c8ca1745b33ea6adc31b39e2003646370ec7f52fe1e89af6903a69aaca
SHA512

3d779d6b1ee667a27cf124d41397496620920a7e0544f8fe143e2ab6170148f2c9d6a0f05cef2528827cde20d03c99407d06f4e9a39db13bcb8984ab73ce7dd6
SSDEEP

3072:vd+7xl60FFPbkGF+7IFNj84EvodYVnHkgZL1P/7aJ3NrXWPsZa4FSUqcUKZrVU:lOhpblSi/I991P/7aTzna4zqaVU

Score

10^/10

xloader mabs loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

mabs

Decoy

joiderqm.com

hyc306.com

ouchplus.asia

abrosnm3.com

hospitalanti-infectives.com

ala-co.com

morrisonltts.net

tradingimpulse.com

invisibleimagination.com

jdjshop.com

huntedby.com

szsgfdzx.com

germfightersusaiowa.com

pahaadpost.com

obrankers.com

plaeralum.com

getfitwithmeministry.com

smartswaploan.com

gypsyjewelrydesigns.com

meetgoodwill.info

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2344-2-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2200 set thread context of 2344	2200	f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe

pid	Process
2344	f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe

pid	Process
2200	f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2200 wrote to memory of 2344	2200	f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe	29
PID 2200 wrote to memory of 2344	2200	f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe	29
PID 2200 wrote to memory of 2344	2200	f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe	29
PID 2200 wrote to memory of 2344	2200	f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe	29
PID 2200 wrote to memory of 2344	2200	f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-0-0x0000000001140000-0x0000000001146000-memory.dmp

Filesize
24KB

Download
memory/2200-1-0x0000000000290000-0x0000000000292000-memory.dmp

Filesize
8KB

Download
memory/2344-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2344-3-0x00000000008C0000-0x0000000000BC3000-memory.dmp

Filesize
3.0MB

Download