Analysis
- max time kernel
93s - max time network
114s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
19/04/2024, 06:50
General
- Target f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe
- Size 763KB
- Sample240419-hl8k8abc53
- SHA256 de0204a1139358642d9fb0ceb2a62b58fe7f89cf254509f83c636b9ee2aa25ce
Malware Config
Extracted
-
xloader
-
2.3
-
qcir
-
bahucharoptical.com
-
mididis.net
-
neenaknowsrealestate.com
-
thenaughtywoodworker.com
-
blackbackedbusiness.com
-
softwaremapper.com
-
kot-lab.net
-
ceipsanjuanbautista.net
-
binewsmontgomery.com
-
truenorthhomeschooling.com
-
careerbookstore.online
-
lilycampbellbooks.com
-
mbhpoetry.com
-
dropserved.com
-
fgroupsrilanka.com
-
theearwitness.com
-
greenbaycommunitytheater.com
-
fullscopebackgrounds.com
-
qzi-iz.com
-
jilleolk.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9bded6d9401144a3485ddd295dc2b7e_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/412-8-0x00000000752F0000-0x0000000075AA0000-memory.dmp
memory/412-9-0x0000000005200000-0x0000000005210000-memory.dmp
memory/412-2-0x0000000005760000-0x0000000005D04000-memory.dmp
memory/412-3-0x0000000005250000-0x00000000052E2000-memory.dmp
memory/412-4-0x00000000052F0000-0x000000000538C000-memory.dmp
memory/412-5-0x0000000005200000-0x0000000005210000-memory.dmp
memory/412-0-0x0000000000780000-0x0000000000846000-memory.dmp
memory/412-6-0x00000000051F0000-0x00000000051FA000-memory.dmp
memory/412-1-0x00000000752F0000-0x0000000075AA0000-memory.dmp
memory/412-7-0x0000000005740000-0x0000000005752000-memory.dmp
memory/412-10-0x0000000006B90000-0x0000000006C30000-memory.dmp
memory/412-11-0x0000000009170000-0x00000000091A0000-memory.dmp
memory/412-14-0x00000000752F0000-0x0000000075AA0000-memory.dmp
memory/4848-12-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4848-15-0x00000000018B0000-0x0000000001BFA000-memory.dmp
memory/4848-16-0x00000000018B0000-0x0000000001BFA000-memory.dmp