xloader | 4938b1c8ca1745b33ea6adc31b39e2003646370ec7f52fe1e89af6903a69aaca

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe
Size

224KB
MD5

f5fa2e043b901e50f0e6e8ad0e4f7074
SHA1

221c67c606a3a2e0c5bfa8b57d7c749e29b074d8
SHA256

4938b1c8ca1745b33ea6adc31b39e2003646370ec7f52fe1e89af6903a69aaca
SHA512

3d779d6b1ee667a27cf124d41397496620920a7e0544f8fe143e2ab6170148f2c9d6a0f05cef2528827cde20d03c99407d06f4e9a39db13bcb8984ab73ce7dd6
SSDEEP

3072:vd+7xl60FFPbkGF+7IFNj84EvodYVnHkgZL1P/7aJ3NrXWPsZa4FSUqcUKZrVU:lOhpblSi/I991P/7aTzna4zqaVU

Score

10^/10

xloader mabs loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

mabs

Decoy

joiderqm.com

hyc306.com

ouchplus.asia

abrosnm3.com

hospitalanti-infectives.com

ala-co.com

morrisonltts.net

tradingimpulse.com

invisibleimagination.com

jdjshop.com

huntedby.com

szsgfdzx.com

germfightersusaiowa.com

pahaadpost.com

obrankers.com

plaeralum.com

getfitwithmeministry.com

smartswaploan.com

gypsyjewelrydesigns.com

meetgoodwill.info

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1252-2-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe

description	pid	Process	procid_target
PID 3392 set thread context of 1252	3392	f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe

pid	Process
1252	f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe
1252	f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe

pid	Process
3392	f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe

description	pid	Process	procid_target
PID 3392 wrote to memory of 1252	3392	f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe	87
PID 3392 wrote to memory of 1252	3392	f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe	87
PID 3392 wrote to memory of 1252	3392	f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe	87
PID 3392 wrote to memory of 1252	3392	f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Users\Admin\AppData\Local\Temp\f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f5fa2e043b901e50f0e6e8ad0e4f7074_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1252-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1252-3-0x00000000018F0000-0x0000000001C3A000-memory.dmp

Filesize
3.3MB

Download
memory/3392-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3392-1-0x0000000000AA0000-0x0000000000AA2000-memory.dmp

Filesize
8KB

Download