Analysis
- max time kernel
92s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
19/04/2024, 00:31
General
- Target f91a66d080744b9e8b946984d6d747c4_JaffaCakes118.exe
- Size 960KB
- Sample240419-at2tmsbc59
- SHA256 c6a1a1a68b5faac43930deeab9cd6745bde62869786e21e0681b3dc0973afa80
Malware Config
Extracted
-
xloader
-
2.3
-
m6b5
-
ixtarbelize.com
-
pheamal.com
-
daiyncc.com
-
staydoubted.com
-
laagerlitigation.club
-
sukrantastansakarya.com
-
esupport.ltd
-
vetscontracting.net
-
themuslimlife.coach
-
salmanairs.com
-
somatictherapyservices.com
-
lastminuteminister.com
-
comunicarbuenosaires.com
-
kazuya.tech
-
insightlyservicedev.com
-
redevelopment38subhashnagar.com
-
thefutureinvestor.com
-
simplysu.com
-
lagu45.com
-
livingstonpistolpermit.com
Signatures
- Detect ZGRat V1 1 IoCs
- Xloader
Xloader is a rebranded version of Formbook malware.
- ZGRat
ZGRat is remote access trojan written in C#.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f91a66d080744b9e8b946984d6d747c4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f91a66d080744b9e8b946984d6d747c4_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f91a66d080744b9e8b946984d6d747c4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f91a66d080744b9e8b946984d6d747c4_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3536-10-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3536-14-0x0000000001740000-0x0000000001A8A000-memory.dmp
memory/3536-13-0x0000000001740000-0x0000000001A8A000-memory.dmp
memory/4424-6-0x0000000005440000-0x0000000005450000-memory.dmp
memory/4424-4-0x0000000005120000-0x0000000005196000-memory.dmp
memory/4424-5-0x0000000005240000-0x00000000052DC000-memory.dmp
memory/4424-0-0x00000000006E0000-0x00000000007D6000-memory.dmp
memory/4424-7-0x0000000005040000-0x000000000505E000-memory.dmp
memory/4424-8-0x00000000052F0000-0x0000000005370000-memory.dmp
memory/4424-9-0x0000000005070000-0x0000000005086000-memory.dmp
memory/4424-3-0x0000000005080000-0x0000000005112000-memory.dmp
memory/4424-12-0x00000000747F0000-0x0000000074FA0000-memory.dmp
memory/4424-2-0x0000000005550000-0x0000000005AF4000-memory.dmp
memory/4424-1-0x00000000747F0000-0x0000000074FA0000-memory.dmp