xloader | 6dbd578bacfac6bee49b778b85cd62926c65a7f23bb33ceec705686474308898

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe
Size

430KB
MD5

439ec2917b590c3172a790f519f751b7
SHA1

5280d1249d0ca942d22d6c78cf864f129d867b65
SHA256

6dbd578bacfac6bee49b778b85cd62926c65a7f23bb33ceec705686474308898
SHA512

012e86735aeac946c4f9d419befa80801f8912c711eb33531e49bb11b993ac339c845e1a2761485f0e2d37e1e5d877201542ba5927a9c90cc371683045bb5ebf
SSDEEP

6144:G8LxBVkCInwNqWBD5Xz560A5A8/0FwN47sfJUhhRXmRNOE6SIfBQW8aFm6HlVGjM:bFBtLAq8c7bhh/l58aA6FVGj45

Score

10^/10

xloader da5x loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

da5x

Decoy

alles-abgedeckt.com

bluetv.club

iphone13.onl

the-new-era.space

rezeromanga.net

dgwb1.com

fetch-an-us-itchy.zone

attmleather.com

clearthefear.com

clinmedicaresearch.com

dancinghares.biz

permitsgestaodetributosad.com

108manga.com

arrivalofthelightbeings.com

sasanos.com

yfpawn.com

hongduozhong.online

abqcraftshows.net

100edwardsimpson.com

comprayventachatarra.com

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/3068-8-0x0000000000400000-0x0000000000429000-memory.dmp	xloader

Loads dropped DLL 1 IoCs

pid	Process
2292	439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2292 set thread context of 3068	2292	439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3068	439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 3068	2292	439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe	31
PID 2292 wrote to memory of 3068	2292	439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe	31
PID 2292 wrote to memory of 3068	2292	439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe	31
PID 2292 wrote to memory of 3068	2292	439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe	31
PID 2292 wrote to memory of 3068	2292	439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe	31
PID 2292 wrote to memory of 3068	2292	439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe	31
PID 2292 wrote to memory of 3068	2292	439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\439ec2917b590c3172a790f519f751b7_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsjE61C.tmp\gnokeofcx.dll

Filesize
17KB

MD5
1d6dbd89d81d6216f259c9f35c40c42c

SHA1
b0b25bbb32c2c8b06e8a2a12706ca25e85bfb850

SHA256
781e084ab8b4ee8388ff2cbc44c502f0d1aa164556c80931ca12a9e8d525f500

SHA512
aa94d3ac2e64901141fc3102263f547e245546ba44db4215848063206d9fbb7af6e4dde075fd8ac16a06e0c8ab94f56922b2dc76b4fe301ba436f106e0cbe856

Download Submit
memory/3068-8-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download