xloader | a42fcf07a49813ee9169d0c3e69fd3b7dd98a2d3316d9861dcc8de4caa7487cd

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f84e59e42690ede739531d41ebea3d07_JaffaCakes118.exe
Size

712KB
MD5

f84e59e42690ede739531d41ebea3d07
SHA1

03544033cdd8cf9c911e3bad6095da4256495606
SHA256

a42fcf07a49813ee9169d0c3e69fd3b7dd98a2d3316d9861dcc8de4caa7487cd
SHA512

0155f02751e5dd487e4550ae52fb0d1d4e0a205ae1f250920150bdab495e909ccb47b984645d915b37a4aea8f39bcef5ea50c89d8810fc10e99aac842991a9e9
SSDEEP

12288:IFfumitB/fZhhgDweuBiMkk5i5jcQnmQ9AuchIOixdTVIzUUP1AUnzUSM/:IFWXzePuUMkB5jcsmQ9A5jiPWzZ

Score

10^/10

xloader n58i loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

n58i

Decoy

nl-cafe.com

votetedjaleta.com

britrobertsrealtor.com

globipark.com

citysucces.com

verisignwebsite-verified.com

riddlepc.com

rosecityclimbing.com

oleandrinextract.com

salmankonstruksi.com

needhamchannel.com

refreshx2z.com

youth66.com

pla-russia.com

halloweenmaskpro.com

exdysis.com

1gcz.com

lookgoodman.com

rlxagva.com

stlcityc.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2404-14-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

f84e59e42690ede739531d41ebea3d07_JaffaCakes118.exe

description pid process target process

PID 2228 set thread context of 2404 2228 f84e59e42690ede739531d41ebea3d07_JaffaCakes118.exe RegSvcs.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2552 2404 WerFault.exe RegSvcs.exe

description	pid	process	target process
PID 2228 set thread context of 2404	2228	f84e59e42690ede739531d41ebea3d07_JaffaCakes118.exe	RegSvcs.exe

pid	pid_target	process	target process
2552	2404	WerFault.exe	RegSvcs.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

f84e59e42690ede739531d41ebea3d07_JaffaCakes118.exeRegSvcs.exe

description	pid	process	target process
PID 2228 wrote to memory of 2404	2228	f84e59e42690ede739531d41ebea3d07_JaffaCakes118.exe	RegSvcs.exe
PID 2228 wrote to memory of 2404	2228	f84e59e42690ede739531d41ebea3d07_JaffaCakes118.exe	RegSvcs.exe
PID 2228 wrote to memory of 2404	2228	f84e59e42690ede739531d41ebea3d07_JaffaCakes118.exe	RegSvcs.exe
PID 2228 wrote to memory of 2404	2228	f84e59e42690ede739531d41ebea3d07_JaffaCakes118.exe	RegSvcs.exe
PID 2228 wrote to memory of 2404	2228	f84e59e42690ede739531d41ebea3d07_JaffaCakes118.exe	RegSvcs.exe
PID 2228 wrote to memory of 2404	2228	f84e59e42690ede739531d41ebea3d07_JaffaCakes118.exe	RegSvcs.exe
PID 2228 wrote to memory of 2404	2228	f84e59e42690ede739531d41ebea3d07_JaffaCakes118.exe	RegSvcs.exe
PID 2228 wrote to memory of 2404	2228	f84e59e42690ede739531d41ebea3d07_JaffaCakes118.exe	RegSvcs.exe
PID 2228 wrote to memory of 2404	2228	f84e59e42690ede739531d41ebea3d07_JaffaCakes118.exe	RegSvcs.exe
PID 2228 wrote to memory of 2404	2228	f84e59e42690ede739531d41ebea3d07_JaffaCakes118.exe	RegSvcs.exe
PID 2404 wrote to memory of 2552	2404	RegSvcs.exe	WerFault.exe
PID 2404 wrote to memory of 2552	2404	RegSvcs.exe	WerFault.exe
PID 2404 wrote to memory of 2552	2404	RegSvcs.exe	WerFault.exe
PID 2404 wrote to memory of 2552	2404	RegSvcs.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f84e59e42690ede739531d41ebea3d07_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f84e59e42690ede739531d41ebea3d07_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 36
3⤵
- Program crash
PID:2552

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2228-6-0x0000000004870000-0x00000000048B0000-memory.dmp

Filesize
256KB

Download
memory/2228-1-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2228-2-0x0000000004770000-0x0000000004802000-memory.dmp

Filesize
584KB

Download
memory/2228-3-0x0000000004870000-0x00000000048B0000-memory.dmp

Filesize
256KB

Download
memory/2228-4-0x00000000008A0000-0x00000000008B8000-memory.dmp

Filesize
96KB

Download
memory/2228-5-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2228-0-0x00000000012B0000-0x0000000001368000-memory.dmp

Filesize
736KB

Download
memory/2228-7-0x0000000005B30000-0x0000000005BD6000-memory.dmp

Filesize
664KB

Download
memory/2228-15-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2228-8-0x0000000000C10000-0x0000000000C46000-memory.dmp

Filesize
216KB

Download
memory/2404-9-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2404-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2404-14-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2404-11-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download