xloader | 83fb913f2698b853cb1ef1d9bd54bf06c7bd660028f1440d3c080c02ab4b9f1e

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 16:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe
Size

754KB
MD5

f85d9eb0cf28a546f016ebce68f9269a
SHA1

6ed691cc909f17d7c289eec4542a067939877aaf
SHA256

83fb913f2698b853cb1ef1d9bd54bf06c7bd660028f1440d3c080c02ab4b9f1e
SHA512

3c719f6b524d7c2827623ae458e6a405d73229fced90211eab677da4eee936b06c05cade253f32e993dff05334687b64ffa0cc8045fef00b57649dfb92ebdcdd
SSDEEP

12288:vY8iOa950YM/676897lMg5Comh3seWiF9+Q+e6F:/Yw67psg5G3VFdM

Score

10^/10

xloader mej0 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

mej0

Decoy

mtxs8.com

quickskiplondon.com

sltplanner.com

generatedate.com

amsinspections.com

tomrings.com

109friends.com

freelovereading.com

avalapartners.com

nordiqueluxury.com

inmbex.com

everybankatm.com

bo1899.com

ashymeadow.com

pubgm-chickendinner.com

takudolunch.com

carlagremiao.com

actonetheatre.com

wemhealth.com

khasomat.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/5004-11-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4848 set thread context of 5004	4848	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe	99

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5004	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe
5004	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 5004	4848	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe	99
PID 4848 wrote to memory of 5004	4848	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe	99
PID 4848 wrote to memory of 5004	4848	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe	99
PID 4848 wrote to memory of 5004	4848	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe	99
PID 4848 wrote to memory of 5004	4848	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe	99
PID 4848 wrote to memory of 5004	4848	f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe	99

C:\Users\Admin\AppData\Local\Temp\f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Users\Admin\AppData\Local\Temp\f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f85d9eb0cf28a546f016ebce68f9269a_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1044 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:3224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4848-6-0x00000000054D0000-0x000000000556C000-memory.dmp

Filesize
624KB

Download
memory/4848-10-0x0000000008600000-0x0000000008636000-memory.dmp

Filesize
216KB

Download
memory/4848-2-0x0000000005320000-0x0000000005330000-memory.dmp

Filesize
64KB

Download
memory/4848-3-0x0000000005390000-0x0000000005422000-memory.dmp

Filesize
584KB

Download
memory/4848-4-0x0000000002D20000-0x0000000002D3C000-memory.dmp

Filesize
112KB

Download
memory/4848-5-0x00000000059E0000-0x0000000005F84000-memory.dmp

Filesize
5.6MB

Download
memory/4848-8-0x0000000005320000-0x0000000005330000-memory.dmp

Filesize
64KB

Download
memory/4848-14-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/4848-1-0x0000000000730000-0x00000000007F2000-memory.dmp

Filesize
776KB

Download
memory/4848-9-0x0000000006090000-0x00000000060FC000-memory.dmp

Filesize
432KB

Download
memory/4848-0-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/4848-7-0x0000000074C10000-0x00000000753C0000-memory.dmp

Filesize
7.7MB

Download
memory/5004-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5004-13-0x0000000001320000-0x000000000166A000-memory.dmp

Filesize
3.3MB

Download