xloader | e94ab3e9bc6dfb0889e82075cbef674de3c160a8d4bbf9b3d596381bebf492af

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe
Size

688KB
MD5

fdaa7ea645b190b5049db5e11ee65456
SHA1

c96956ef38e91160217379b008b4534d5c7862c6
SHA256

e94ab3e9bc6dfb0889e82075cbef674de3c160a8d4bbf9b3d596381bebf492af
SHA512

95cb0f1614d065db83e7ac94f9fb3587f02d72118ce2b91e7480eb801b484acca64a388eb1e2c944abdc069698d4e888307c1a2d534bfae1fd903d34a577ef9f
SSDEEP

12288:DeZh7/duQkE35lyl9JTY7lVWrMQ4ZwCFaGZS2m:D8dZ5le87zWoQ4ZlaGZy

Score

10^/10

xloader mej0 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

mej0

Decoy

mtxs8.com

quickskiplondon.com

sltplanner.com

generatedate.com

amsinspections.com

tomrings.com

109friends.com

freelovereading.com

avalapartners.com

nordiqueluxury.com

inmbex.com

everybankatm.com

bo1899.com

ashymeadow.com

pubgm-chickendinner.com

takudolunch.com

carlagremiao.com

actonetheatre.com

wemhealth.com

khasomat.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2752-12-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe

description	pid	process	target process
PID 2944 set thread context of 2752	2944	fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe	fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe

pid process

2752 fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe

pid	process
2752	fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe

description	pid	process	target process
PID 2944 wrote to memory of 2752	2944	fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe	fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe
PID 2944 wrote to memory of 2752	2944	fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe	fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe
PID 2944 wrote to memory of 2752	2944	fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe	fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe
PID 2944 wrote to memory of 2752	2944	fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe	fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe
PID 2944 wrote to memory of 2752	2944	fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe	fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe
PID 2944 wrote to memory of 2752	2944	fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe	fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe
PID 2944 wrote to memory of 2752	2944	fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe	fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2944

C:\Users\Admin\AppData\Local\Temp\fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdaa7ea645b190b5049db5e11ee65456_JaffaCakes118.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2752

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2752-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2752-14-0x0000000000900000-0x0000000000C03000-memory.dmp

Filesize
3.0MB

Download
memory/2752-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2752-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2752-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2944-3-0x0000000000370000-0x000000000038C000-memory.dmp

Filesize
112KB

Download
memory/2944-6-0x0000000004E40000-0x0000000004EA6000-memory.dmp

Filesize
408KB

Download
memory/2944-7-0x0000000000C60000-0x0000000000C8E000-memory.dmp

Filesize
184KB

Download
memory/2944-5-0x0000000004D20000-0x0000000004D60000-memory.dmp

Filesize
256KB

Download
memory/2944-4-0x0000000074620000-0x0000000074D0E000-memory.dmp

Filesize
6.9MB

Download
memory/2944-1-0x0000000074620000-0x0000000074D0E000-memory.dmp

Filesize
6.9MB

Download
memory/2944-2-0x0000000004D20000-0x0000000004D60000-memory.dmp

Filesize
256KB

Download
memory/2944-0-0x0000000000F70000-0x0000000001022000-memory.dmp

Filesize
712KB

Download
memory/2944-13-0x0000000074620000-0x0000000074D0E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads