Analysis
- max time kernel
139s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
19/07/2024, 03:41
General
- Target 5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe
- Size 2.4MB
- Sample240719-d8yx3svanf
- SHA256 842898cfb97f8c01b55ea1aaf32ffffb5497e1dbe6ea309bfa715e37212bb6da
Malware Config
Extracted
-
xloader
-
2.3
-
u2km
-
fairhygiene.com
-
adminnovicepro.xyz
-
mysteptofreedom.com
-
beachstoreonline.com
-
outofmyfacemace.com
-
jjudit.com
-
x-box2send22.club
-
genuineconsultingservices.com
-
avreeaylwomackoneil.online
-
englandisrael.com
-
wealthwelb.com
-
ettransfertest.com
-
digitalrealestate.computer
-
aryamansaigoa.com
-
caterinebat.com
-
bostonm.info
-
n1nte.net
-
newvisiontravels.com
-
ma-apo.com
-
samrcaldwell.net
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Beds Protector Packer 1 IoCs
Detects Beds Protector packer used to load .NET malware.
- Xloader payload 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5a53f07640f66b7e88ac3d0b4acd5f9a_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 11562⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4556 -ip 45561⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4556-0-0x000000007485E000-0x000000007485F000-memory.dmp
memory/4556-1-0x00000000009B0000-0x0000000000C26000-memory.dmp
memory/4556-2-0x0000000074850000-0x0000000075000000-memory.dmp
memory/4556-3-0x0000000005C80000-0x0000000006224000-memory.dmp
memory/4556-4-0x0000000005880000-0x0000000005AE8000-memory.dmp
memory/4556-5-0x0000000005B90000-0x0000000005C22000-memory.dmp
memory/4556-6-0x0000000006230000-0x00000000062CC000-memory.dmp
memory/4556-7-0x00000000055B0000-0x00000000055C6000-memory.dmp
memory/4556-10-0x0000000074850000-0x0000000075000000-memory.dmp
memory/4716-8-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4716-9-0x0000000001B60000-0x0000000001EAA000-memory.dmp