xloader | 4761bbde870190a51ffa8598c442af5b834476c02839626eebc85fc21eb94c17

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

544ece457e19d0f63969651b6a61aa49_JaffaCakes118.exe
Size

416KB
MD5

544ece457e19d0f63969651b6a61aa49
SHA1

f7564ce804a93ee22d38669a611266eba0449878
SHA256

4761bbde870190a51ffa8598c442af5b834476c02839626eebc85fc21eb94c17
SHA512

0d7ecf3945d798cb577b56e8c5dad906207e484889761e1671a93d1c9b0995897faf8d9058e3e53c4c849a0c019fedf5330317d443ec2d4fbcc7dbac92deb3ea
SSDEEP

12288:zE+nOoXmJLVdEtCDpz3Vw4qOJg8RlKQtSV1Hm:zEJVdEtCDpz3VO4rPKQtSHHm

Score

10^/10

xloader ggb4 loader rat

Malware Config

Extracted

Family

xloader

Version

2.1

Campaign

ggb4

Decoy

page-helpdesk-submit37950.com

deathmedical.com

cr20business.com

4469783.com

shoesupweb.com

magallanes.xyz

mayfairfestival.com

obezzarazhivanie-vozduha.pro

discountsstore.store

globejetflights.com

coffeeonestop.com

telemedottawa.com

southwestcri.com

laowuts.com

menwa.online

upintothegame.com

pennypinchersinc.com

luchamosporustednj.com

thirdistheword.com

adonmarket.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/720-13-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

544ece457e19d0f63969651b6a61aa49_JaffaCakes118.exe

description	pid	Process	procid_target
PID 4472 set thread context of 720	4472	544ece457e19d0f63969651b6a61aa49_JaffaCakes118.exe	96

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

544ece457e19d0f63969651b6a61aa49_JaffaCakes118.exe

pid	Process
720	544ece457e19d0f63969651b6a61aa49_JaffaCakes118.exe
720	544ece457e19d0f63969651b6a61aa49_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

544ece457e19d0f63969651b6a61aa49_JaffaCakes118.exe

description	pid	Process	procid_target
PID 4472 wrote to memory of 720	4472	544ece457e19d0f63969651b6a61aa49_JaffaCakes118.exe	96
PID 4472 wrote to memory of 720	4472	544ece457e19d0f63969651b6a61aa49_JaffaCakes118.exe	96
PID 4472 wrote to memory of 720	4472	544ece457e19d0f63969651b6a61aa49_JaffaCakes118.exe	96
PID 4472 wrote to memory of 720	4472	544ece457e19d0f63969651b6a61aa49_JaffaCakes118.exe	96
PID 4472 wrote to memory of 720	4472	544ece457e19d0f63969651b6a61aa49_JaffaCakes118.exe	96
PID 4472 wrote to memory of 720	4472	544ece457e19d0f63969651b6a61aa49_JaffaCakes118.exe	96

C:\Users\Admin\AppData\Local\Temp\544ece457e19d0f63969651b6a61aa49_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\544ece457e19d0f63969651b6a61aa49_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Users\Admin\AppData\Local\Temp\544ece457e19d0f63969651b6a61aa49_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\544ece457e19d0f63969651b6a61aa49_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/720-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/720-16-0x0000000001A10000-0x0000000001D5A000-memory.dmp

Filesize
3.3MB

Download
memory/4472-8-0x0000000005A60000-0x0000000005A6A000-memory.dmp

Filesize
40KB

Download
memory/4472-9-0x000000007514E000-0x000000007514F000-memory.dmp

Filesize
4KB

Download
memory/4472-4-0x0000000005600000-0x0000000005692000-memory.dmp

Filesize
584KB

Download
memory/4472-5-0x0000000005550000-0x000000000555A000-memory.dmp

Filesize
40KB

Download
memory/4472-6-0x0000000005820000-0x0000000005876000-memory.dmp

Filesize
344KB

Download
memory/4472-7-0x0000000075140000-0x00000000758F0000-memory.dmp

Filesize
7.7MB

Download
memory/4472-0-0x000000007514E000-0x000000007514F000-memory.dmp

Filesize
4KB

Download
memory/4472-3-0x0000000005BB0000-0x0000000006154000-memory.dmp

Filesize
5.6MB

Download
memory/4472-10-0x0000000075140000-0x00000000758F0000-memory.dmp

Filesize
7.7MB

Download
memory/4472-11-0x0000000006680000-0x00000000066D0000-memory.dmp

Filesize
320KB

Download
memory/4472-12-0x00000000066D0000-0x0000000006700000-memory.dmp

Filesize
192KB

Download
memory/4472-2-0x0000000005560000-0x00000000055FC000-memory.dmp

Filesize
624KB

Download
memory/4472-15-0x0000000075140000-0x00000000758F0000-memory.dmp

Filesize
7.7MB

Download
memory/4472-1-0x0000000000B20000-0x0000000000B8E000-memory.dmp

Filesize
440KB

Download