xloader | 56b03d3827cb209e0cb9fd3410418844f2791a4108e7424c57607c10b328f5f0

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fbbab17658dcde448682cc54c33365c_JaffaCakes118.exe
Size

496KB
MD5

2fbbab17658dcde448682cc54c33365c
SHA1

97ecc1fe2065cb5c509e824c6583b3d589ae7bf5
SHA256

56b03d3827cb209e0cb9fd3410418844f2791a4108e7424c57607c10b328f5f0
SHA512

e92de8a7baf6213b991b4778d6ecc718ba502b41eba273331b51e340bd7e60cc1f57e82f1b3be46af684b98084db61a1d367fa1eca04f5c16a5f9d91ba515757
SSDEEP

12288:bqDmrfjC2IxWQ8/yhWrUgG+bdnAXVnDt:bXfIU9VhA7

Score

10^/10

xloader ur06 loader rat

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ur06

Decoy

philippebrooksdesign.com

cmoorestudio.com

profille-sarina23tammara.club

dqulxe.com

uiffinger.com

nolarapper.com

maconanimalexterminator.com

bisovka.com

loveisloveent.com

datication.com

spxo66.com

drhelpnow.com

ladybug-cle.com

macocome.com

thepoppysocks.com

eldritchparadox.com

mercadolibre.company

ismartfarm.com

kansascarlot.com

kevinld.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/572-12-0x0000000000400000-0x0000000000428000-memory.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2928 set thread context of 572	2928	2fbbab17658dcde448682cc54c33365c_JaffaCakes118.exe	31

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
572	2fbbab17658dcde448682cc54c33365c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 572	2928	2fbbab17658dcde448682cc54c33365c_JaffaCakes118.exe	31
PID 2928 wrote to memory of 572	2928	2fbbab17658dcde448682cc54c33365c_JaffaCakes118.exe	31
PID 2928 wrote to memory of 572	2928	2fbbab17658dcde448682cc54c33365c_JaffaCakes118.exe	31
PID 2928 wrote to memory of 572	2928	2fbbab17658dcde448682cc54c33365c_JaffaCakes118.exe	31
PID 2928 wrote to memory of 572	2928	2fbbab17658dcde448682cc54c33365c_JaffaCakes118.exe	31
PID 2928 wrote to memory of 572	2928	2fbbab17658dcde448682cc54c33365c_JaffaCakes118.exe	31
PID 2928 wrote to memory of 572	2928	2fbbab17658dcde448682cc54c33365c_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\2fbbab17658dcde448682cc54c33365c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2fbbab17658dcde448682cc54c33365c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\2fbbab17658dcde448682cc54c33365c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\2fbbab17658dcde448682cc54c33365c_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/572-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/572-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/572-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/572-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/572-14-0x0000000000B00000-0x0000000000E03000-memory.dmp

Filesize
3.0MB

Download
memory/2928-0-0x0000000074B21000-0x0000000074B22000-memory.dmp

Filesize
4KB

Download
memory/2928-1-0x0000000074B20000-0x00000000750CB000-memory.dmp

Filesize
5.7MB

Download
memory/2928-2-0x0000000074B20000-0x00000000750CB000-memory.dmp

Filesize
5.7MB

Download
memory/2928-3-0x0000000074B20000-0x00000000750CB000-memory.dmp

Filesize
5.7MB

Download
memory/2928-4-0x0000000074B20000-0x00000000750CB000-memory.dmp

Filesize
5.7MB

Download
memory/2928-13-0x0000000074B20000-0x00000000750CB000-memory.dmp

Filesize
5.7MB

Download