Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20-04-2024 17:39

General

  • Target

    fd45b4fe49d0e8c38c34fdd1bdad1dda_JaffaCakes118.exe

  • Size

    524KB

  • MD5

    fd45b4fe49d0e8c38c34fdd1bdad1dda

  • SHA1

    955da56927ee2d3afe02a1cef22d7384fe7066eb

  • SHA256

    5d5aa4f1afaa9dd98bc1317f5b8e190cf21130d465da575fac9d4fbc6b3fb3af

  • SHA512

    dffd9842de31f170c2f6d22cf067ad7f4aacd97011f0d5751071baa9011fcab90a1e6e21c3301241107efbd8b0aa40707dde0e7003082ff41cb08cdfcdc56589

  • SSDEEP

    12288:9E+M7a6xtv2uMblHYqZ8kr6Z+A2skebXul0tGsucD3SB:K+NctvvalY5e6xD30sucDiB

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b5ce

Decoy

advellerd.xyz

giasuvina.com

arab-xt-pro.com

ahsltu2ua4.com

trasportesemmanuel.com

kissimmeesoccercup.com

studyengland.com

m2volleyballclub.com

shyuehuan.com

elsml.com

blog-x-history.top

coditeu.com

allattachments.net

vigautruc.com

mentication.com

zambiaedu.xyz

filadelfiacenter.com

avlaborsourceinc.info

tameka-stewart.com

studio-cleo.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd45b4fe49d0e8c38c34fdd1bdad1dda_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fd45b4fe49d0e8c38c34fdd1bdad1dda_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Users\Admin\AppData\Local\Temp\fd45b4fe49d0e8c38c34fdd1bdad1dda_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\fd45b4fe49d0e8c38c34fdd1bdad1dda_JaffaCakes118.exe"
      2⤵
        PID:2648
      • C:\Users\Admin\AppData\Local\Temp\fd45b4fe49d0e8c38c34fdd1bdad1dda_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\fd45b4fe49d0e8c38c34fdd1bdad1dda_JaffaCakes118.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2664

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1964-6-0x00000000054E0000-0x0000000005556000-memory.dmp
      Filesize

      472KB

    • memory/1964-1-0x0000000074200000-0x00000000748EE000-memory.dmp
      Filesize

      6.9MB

    • memory/1964-2-0x0000000004C30000-0x0000000004C70000-memory.dmp
      Filesize

      256KB

    • memory/1964-3-0x00000000003F0000-0x00000000003FA000-memory.dmp
      Filesize

      40KB

    • memory/1964-4-0x0000000074200000-0x00000000748EE000-memory.dmp
      Filesize

      6.9MB

    • memory/1964-5-0x0000000004C30000-0x0000000004C70000-memory.dmp
      Filesize

      256KB

    • memory/1964-0-0x0000000000880000-0x000000000090A000-memory.dmp
      Filesize

      552KB

    • memory/1964-14-0x0000000074200000-0x00000000748EE000-memory.dmp
      Filesize

      6.9MB

    • memory/2664-7-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/2664-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
      Filesize

      4KB

    • memory/2664-9-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/2664-13-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/2664-15-0x0000000000AA0000-0x0000000000DA3000-memory.dmp
      Filesize

      3.0MB