xloader | 050249009735072542f00c432d35a71de4516aaee6fe7d5bfac1c8cda838e1f1

General

Target

f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe
Size

760KB
MD5

f6e864629bc2117fb5cc3da3e33d6483
SHA1

57ce16786eb6a4c49cfc6c794d012187a1ab7eaf
SHA256

050249009735072542f00c432d35a71de4516aaee6fe7d5bfac1c8cda838e1f1
SHA512

aba973473ba7dd58e7aa25a8ab17390f90b5aca627771b5cb1fe3d3cb0f88c5ff936dfbba7b1a71bd798ce68e3e3adfbdc2fc9e7eed2434150c6f377795a0730
SSDEEP

12288:yuHHfYnbiuj4BiEOyHpBvygTUxiAuG0fEXj8l2hh/khmwizg:yunfYnbiuj40+pBvygA8WzC2hlRwl

Score

10^/10

xloader nwru agilenet loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

nwru

Decoy

zjkhyo.com

mogreener.com

galanpresente.com

anthologistliving.com

jfl-info.net

cascobaycuttlerly.com

nefertityeg.com

greatescapefurniture.com

primulashop.com

xn--cittinrete-k4a.com

drugstoire.com

kefaloniabride.com

viralgenstudents.com

makerwl.com

rubyweed.com

badenio.com

smartcontracttraders.com

lcscards-veilig.icu

qf553.com

dnhsxm.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3292-15-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/4160-7-0x0000000006BB0000-0x0000000006BD8000-memory.dmp	agile_net

Suspicious use of SetThreadContext 1 IoCs

Processes:

f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe

description	pid	process	target process
PID 4160 set thread context of 3292	4160	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exef6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe

pid	process
4160	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe
4160	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe
4160	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe
3292	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe
3292	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 4160 f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	4160	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe

description	pid	process	target process
PID 4160 wrote to memory of 3292	4160	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe
PID 4160 wrote to memory of 3292	4160	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe
PID 4160 wrote to memory of 3292	4160	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe
PID 4160 wrote to memory of 3292	4160	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe
PID 4160 wrote to memory of 3292	4160	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe
PID 4160 wrote to memory of 3292	4160	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe	f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4160

C:\Users\Admin\AppData\Local\Temp\f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f6e864629bc2117fb5cc3da3e33d6483_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4164 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3292-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3292-16-0x00000000011F0000-0x000000000153A000-memory.dmp

Filesize
3.3MB

Download
memory/4160-8-0x0000000005610000-0x0000000005620000-memory.dmp

Filesize
64KB

Download
memory/4160-9-0x0000000006BE0000-0x0000000006C46000-memory.dmp

Filesize
408KB

Download
memory/4160-4-0x0000000005410000-0x00000000054AC000-memory.dmp

Filesize
624KB

Download
memory/4160-5-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/4160-6-0x0000000005610000-0x0000000005620000-memory.dmp

Filesize
64KB

Download
memory/4160-7-0x0000000006BB0000-0x0000000006BD8000-memory.dmp

Filesize
160KB

Download
memory/4160-0-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/4160-3-0x0000000005370000-0x0000000005402000-memory.dmp

Filesize
584KB

Download
memory/4160-10-0x0000000006A20000-0x0000000006A42000-memory.dmp

Filesize
136KB

Download
memory/4160-11-0x0000000005610000-0x0000000005620000-memory.dmp

Filesize
64KB

Download
memory/4160-12-0x0000000005610000-0x0000000005620000-memory.dmp

Filesize
64KB

Download
memory/4160-13-0x00000000013D0000-0x00000000013E4000-memory.dmp

Filesize
80KB

Download
memory/4160-14-0x00000000013E0000-0x00000000013E6000-memory.dmp

Filesize
24KB

Download
memory/4160-2-0x0000000005880000-0x0000000005E24000-memory.dmp

Filesize
5.6MB

Download
memory/4160-1-0x0000000000850000-0x0000000000914000-memory.dmp

Filesize
784KB

Download
memory/4160-18-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads