xloader | 83fb913f2698b853cb1ef1d9bd54bf06c7bd660028f1440d3c080c02ab4b9f1e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe
Size

754KB
MD5

f85d9eb0cf28a546f016ebce68f9269a
SHA1

6ed691cc909f17d7c289eec4542a067939877aaf
SHA256

83fb913f2698b853cb1ef1d9bd54bf06c7bd660028f1440d3c080c02ab4b9f1e
SHA512

3c719f6b524d7c2827623ae458e6a405d73229fced90211eab677da4eee936b06c05cade253f32e993dff05334687b64ffa0cc8045fef00b57649dfb92ebdcdd
SSDEEP

12288:vY8iOa950YM/676897lMg5Comh3seWiF9+Q+e6F:/Yw67psg5G3VFdM

Score

10^/10

xloader mej0 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

mej0

Decoy

mtxs8.com

quickskiplondon.com

sltplanner.com

generatedate.com

amsinspections.com

tomrings.com

109friends.com

freelovereading.com

avalapartners.com

nordiqueluxury.com

inmbex.com

everybankatm.com

bo1899.com

ashymeadow.com

pubgm-chickendinner.com

takudolunch.com

carlagremiao.com

actonetheatre.com

wemhealth.com

khasomat.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2496-12-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2528 set thread context of 2496	2528	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2496	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2496	2528	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe	30
PID 2528 wrote to memory of 2496	2528	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe	30
PID 2528 wrote to memory of 2496	2528	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe	30
PID 2528 wrote to memory of 2496	2528	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe	30
PID 2528 wrote to memory of 2496	2528	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe	30
PID 2528 wrote to memory of 2496	2528	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe	30
PID 2528 wrote to memory of 2496	2528	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Local\Temp\f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2496-14-0x0000000000920000-0x0000000000C23000-memory.dmp

Filesize
3.0MB

Download
memory/2496-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2496-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2496-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2528-3-0x00000000005E0000-0x00000000005FC000-memory.dmp

Filesize
112KB

Download
memory/2528-6-0x0000000005240000-0x00000000052AC000-memory.dmp

Filesize
432KB

Download
memory/2528-7-0x0000000000DA0000-0x0000000000DD6000-memory.dmp

Filesize
216KB

Download
memory/2528-5-0x0000000004A60000-0x0000000004AA0000-memory.dmp

Filesize
256KB

Download
memory/2528-4-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/2528-0-0x0000000000FC0000-0x0000000001082000-memory.dmp

Filesize
776KB

Download
memory/2528-2-0x0000000004A60000-0x0000000004AA0000-memory.dmp

Filesize
256KB

Download
memory/2528-1-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/2528-13-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download